secrets-management

name	secrets-management
description	Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word "key", "token", "password", or "secret" appears in the task.
category	security

Secrets Management

Rules:

1. Never hardcode secrets in source files, configs committed to git, or logs.
2. Use environment variables for local development (python-dotenv).
3. Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password CLI) in production.
4. Add .env and *.pem to .gitignore before the first commit.
5. Rotate secrets immediately if they are exposed (leaked in a commit, log, or error message).

Scanning: Use ggshield, truffleHog, or git-secrets in CI to block secret commits.

Anti-patterns:

• os.environ.get('KEY', 'hardcoded_default') in production code.
• Logging full request/response bodies that may contain tokens.