System hardening
Store server secrets outside code
Deliver credentials to the service through protected configuration, limit readers, rotate values, and keep secrets out of commands and logs.
8 minute lesson
A secret committed with the application travels through every clone, build, and backup of that repository.
Use the deployment platform or a root-controlled configuration file with narrow permissions. Avoid command-line arguments that appear in process listings. Separate production and development values and document rotation without printing the value.
Moving a password from Git into a world-readable environment file does not solve exposure. The old value also remains valid until you rotate it.
Check backups and deployment logs for older copies. Rotation ends the credential’s authority, while removing residual plaintext reduces future accidental disclosure and investigation noise.
Move one credential to root-controlled configuration and record its mode, owner, and readers without printing it. Prove the service starts, an unrelated user cannot read it, and the rotated old value no longer authenticates.
Lesson completed