Protect secrets
Keep raw credentials out of sandboxes, browsers, prompts, events, artifacts, and source control.
Outcome
Every credential is resolved only at its approved trusted edge, and a sandbox sees at most a scoped placeholder or short-lived product capability.
Prerequisites
Inventory the owning service, process role, allowed hosts, rotation method, revocation path, and log redaction rule for each credential.
Steps
- Keep repository environment examples to names and descriptions, never values.
- Store production values in provider secret managers.
- Give migration, app, and worker processes separate least-privilege credentials.
- Keep raw model and connector keys in trusted app/worker modules.
- Scrub child-process environments and runtime images.
- Run canary values through errors, traces, prompts, streams, uploads, and provider responses.
The local development bearer value is a local profile convenience, not production authentication and not a credential to reuse elsewhere.
Verify
Secret scanners, public-tree policy, build artifact inspection, and runtime canaries must find no credential. Also prove the sandbox cannot request the secret store or administrative endpoints.
Recover
Treat suspected exposure as real until disproven. Revoke, rotate, stop affected work, preserve access-controlled evidence, identify every destination, and rerun the full canary matrix before reactivation.