Secrets Management with Infisical and Vault Patterns
Injecting secrets at runtime, rotating credentials, and keeping repos free of config leakage.
Nestlancer Editorial
Secrets in .env files committed by accident end careers. Runtime injection via Infisical, Vault, or cloud secret managers keeps credentials rotatable and auditable.
Never in git
- Block commits with
gitleaksortrufflehogin pre-commit and CI .env.exampledocuments keys, never values- CI fetches short-lived tokens from OIDC—not long-lived PATs in GitHub secrets
Injection at runtime
// Bootstrap loads secrets before NestFactory.create
const dbUrl = await secrets.get('DATABASE_URL');
process.env.DATABASE_URL = dbUrl;
Kubernetes: use CSI secret store driver or init containers that mount files read by the app.
Rotation playbook
| Secret type | Rotation cadence |
|---|---|
| Database passwords | 90 days, dual-credential window |
| API keys (third party) | On vendor prompt + quarterly audit |
| JWT signing keys | 6 months with JWKS overlap |
Automate rotation where APIs support it; manual runbooks for the rest.
Least privilege
Service accounts get only secrets for their namespace. Media worker does not read payment API keys.
Secrets management is hygiene, not heroics—boring defaults prevent exciting incidents.
Comments
Loading comments…
Related posts
Design
Brand Identity for Digital-First Products
Logo systems, voice, and visual language that survive app icons and social crops.
Design
Design Ops for Growing Product Teams
Rituals, tooling, and intake processes that keep design shipping with engineering.
Design
Inclusive Design Beyond Compliance Checklists
Cognitive accessibility, plain language, and trauma-informed patterns.
Design
Data Visualization UX for Dashboards
Chart selection, color semantics, and drill-down patterns for decision makers.