Never hardcode secrets. Use a secrets manager:
Solutions:
- HashiCorp Vault: Self-hosted, feature-rich
- AWS Secrets Manager: Managed, integrates with AWS services
- Kubernetes Secrets: Basic, base64 encoded (not encrypted by default)
Best practices:
- Rotate secrets regularly
- Audit access logs
- Use short-lived credentials where possible
- Never log secrets
Application access: App fetches secrets at startup or uses sidecar. Environment variables work but are visible in process lists. Mounted files are safer.