Cloud security basics · Lesson 3 of 5
Keep secrets out of your code
API keys, passwords, and private keys are secrets. Putting them in source code, screenshots, or logs creates additional ways for them to escape.
Deleting the line does not undo exposure
Fictional API key accidentally committed to a shared repository.
- ExposureA key appears in source
History, clones, or logs may retain it.
- Credential responseRevoke or rotate
Follow the approved process so the exposed credential stops working.
- InvestigationCheck use and copies
Look for misuse, address other copies, and prevent recurrence.
Read the visualCan rewriting the latest file make an already copied key secret again?
No. Treat the credential as exposed and respond through the approved process.
Use a managed secret store
Retrieve sensitive values through an approved secret-management system with access controls.
Limit their power and lifetime
Use narrowly scoped credentials and short-lived access where supported.
Treat exposure as a response task
Revoke or rotate an exposed credential, check for misuse, and address every place it was copied.
Put it in context
A fictional API key is committed to a shared repository. Removing the latest line of code is not enough: the key may remain in history or in someone’s copy. Revoke it and investigate usage.
Deleting a leaked secret does not make the old credential safe again.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.