Planned lessonJNR-042-L01

Secrets management basics

On This Lesson 4 topics

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

keep secrets out of source control.

Secrets: passwords, API keys, signing keys, database credentials.
Never commit them, even to a private repo; git history keeps them forever.
Read them from environment variables or a secret store (vault, cloud secret manager) at runtime: ${DB_PASSWORD} in application-prod.yml.
Use different secrets for dev and prod; rotate them; if one leaks, change it, deleting the commit is not enough.
Scan for committed secrets (a pre-commit or CI scanner).

Draft outline details

yaml

spring:
  datasource:
    password: ${DB_PASSWORD}

A key was committed and removed in the next commit. Is it safe?

Show answer

No. It is in history; rotate it.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.