Secrets Management: Stop Playing Whack-a-Mole

If you've ever committed an API key, password, token, certificate, or other secret to a repository, you're not alone. Most secret leaks don't happen because developers don't care about security. They happen because the easiest place to put a secret is inside the code that uses it.

This episode is sponsored by Maze.

In this episode of DevSec Station, Tanya Janca explains why secrets leak, why "just be careful" isn't an effective security strategy, and how developers can stop playing whack-a-mole with exposed credentials. You'll learn why secrets belong outside of source control, how secret scanning can help you find problems before attackers do, and what practical steps you can take to improve your workflow today.

You'll learn:
• why repositories are terrible places to store secrets
• how leaked secrets are discovered and exploited
• why secret leaks are a workflow problem, not a developer problem
• the difference between reacting to leaks and preventing them
• how secrets management tools reduce risk and operational headaches

Tanya walks through a realistic example of how a secret accidentally makes its way into source control, what happens next, and how teams end up trapped in a cycle of rotating credentials and cleaning up incidents. She also shares a practical, developer-friendly process for finding and fixing exposed secrets before they become bigger problems.

One practical action from this episode:

Run a secrets scanner against every repository you actively work on. If you find a real secret:
• rotate it immediately
• move it into a secrets management solution
• update the code so the secret is retrieved securely at runtime

And if your team doesn't have a secrets management tool yet, make the business case for one.

DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.

Follow Tanya:

• https://shehackspurple.ca
• https://newsletter.shehackspurple.ca
• https://youtube.com/@shehackspurple
• https://linkedin.com/in/tanya-janca
• https://tanyajanca.com

This episode is sponsored by Maze.
One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that.

Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary.

Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now.

Learn more about Maze https://mazehq.com/devsec

Episode Transcript

SPEAKER_00 (00:00):
Let's normalize something together very quick.
If you've ever committed asecret to a repo, you are not
alone.
And if you haven't, you probablyjust haven't noticed yet.
Trust me, everyone has done it.
I know I have.
But your repo is not a vault.
And just hoping we don't leaksecrets is not an actual real

(00:23):
strategy.
We can do better.
Hi, I'm Tanya Jenka, also knownas SheHacksPurple.
Welcome to DevSecStation, apodcast for software developers
who want to build more securesoftware.
In each episode, I'll share ashort practical lesson about
secure coding, softwaresecurity, and how to build safer

(00:45):
systems without slowingdevelopment down.
You can jump in at any episode,at any time.
No homework required.
This episode is sponsored byMAISE.
One of the biggest problems insecurity right now is that every
vulnerability or cloud scannersays everything is critical.
And honestly, no one has timefor that.

(01:08):
MAZES uses AI agents toinvestigate vulnerabilities in
context, so you can focus on theissues that are actually
exploitable in your environmentand not just theoretically
scary.
Their AI agents also generateand prioritize fixes that knock
out multiple vulnerabilities atonce, which is honestly the kind

(01:28):
of scaling that security teamsreally need right now.
Learn more about maze atmazehq.com slash devsec.
If you've ever copied a tokeninto a config file, pasted an
API key into an N file, orshared credentials just to get
something working, thisepisode's for you.

(01:50):
Secrets are what computers useto authenticate to each other.
API keys, certificates,passwords, tokens, all of those
things and more are secrets.
And that's what we are going totalk about today.
Secrets aren't leaked becausedevelopers don't care about
security.
They leak because the easiestplace to put a secret is into

(02:12):
the code that uses it.
Git is great at rememberingthings, which is exactly why
it's terrible for forgettingsecrets.
And once a secret has beencommitted, even briefly, it's
effectively public forever.
Not because attackers areactively watching you
specifically, but becausescanning for secrets that have

(02:35):
been leaked is automatic, cheap,and consistent.
Here's how this usually happens.
So you're working locally andyou need a token.
You paste it into a config filejust to test something.
You tell yourself, I'm gonnaremove that later.
But you forget.
And later you commit, and thatcommit gets pushed.

(02:57):
A bot scans it within 60seconds, and your secret has
been compromised.
Even if you deleted it rightaway, it could be too late.
Malicious actors are very readyto exploit this type of mistake.
And then starts thewhack-a-mole.
Rotate the key, invalidate thetoken, update the config, hope

(03:19):
that nothing else breaks.
This is not a developer failure.
It's a workflow problem.
So, how do we fix this?
A bad approach is reacting everytime a secret has been leaked.
Rotate the keys, send thewarnings, talk about it again
during the annual training.

(03:40):
This approach fails because ittreats the symptom and not the
cause.
But a slightly better approachwould be telling developers,
please don't put secrets in yourcode.
I guess that helps a bit, but itrelies on memory and discipline,
and that is far from foolproof.
The best approach is changingour workflow so committing

(04:02):
secrets is difficult or nearimpossible.
This means secrets live outsideour repo in a secret management
tool.
And then they're injected atruntime programmatically.
And our tools stop mistakesbefore they can cause damage.
When the system prevents theleaks for us, developers don't

(04:23):
have to be perfect all the time.
And I don't know about you, butI'm not perfect.
If you do just one thing thisweek, do this.
Get a secret scanner and scanevery repo that you actively
work on.
Here's what I actually mean.
Step one, choose a secretscanner.
Paid or free, I don't care.
It can be built into yourplatform, it could be a

(04:45):
pre-commit hook or a standalonescanner.
The specific tool matters lessthan you actually running it.
Step two, scan all the reposthat you touch, not just the
ones you're proud of andactively working on all of the
ones that you are responsiblefor, please.
Then if you find a real secret,here's what you do next.

(05:07):
Step three, rotate that secretimmediately.
That means generating a brandnew one.
You need to assume it's beencompromised, even if it's really
old.
Even if it probably wasn't used,you must assume the worst here.
Step four, move that secret outof the code and put it into the
secret management tool.

(05:28):
This could be a cloud secretmanager, a vault, whatever your
team uses.
The key point here is that thesecret no longer lives in your
source control, it lives wheresecrets should be stored.
Step five, update the code sonow it pulls the secret from the
secret management tool insteadof having it all hard-coded into
your app.
If you don't have a secretmanagement tool yet, then this

(05:50):
week's homework is very simple.
Ask your boss to get you one.
You can frame it like this boss,I found a secret in my code
today.
That is obviously not good.
I don't want it to happen again.
This tool will ensure that itnever happens again.
Please help me make us moresecure.

(06:11):
You don't need to solve thesecrets in all the apps
everywhere today.
You can just scan your part, fixwhat you found, and make the
next leak much less likely.
This is why secrets managementmatters.
Rotating keys might be annoying,but a security incident is way
worse.

(06:31):
When secrets live outside ofyour repo and we have tools
helping us block mistakes, wecan stop playing whack-a-mole
with our secrets.
Thanks for listening toDevSecStation.
If you enjoyed this episode,please subscribe, share it with
a friend, or leave a review.
It helps more people discoverthe show.

(06:52):
If you'd like to learn more, I'mTanya Jenka, also known as
SheHacksPurple.
And I teach secure codingtraining for software
developers.
You can find me online atshehackspurple.ca.
Thank you for being here.