Managing secrets

Backend security Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Order the steps

Order a zero-downtime database password rotation.

  • Create a second password (or user) alongside the current one
  • Revoke the old password
  • Roll services so they pick up the new secret
  • Confirm no connections use the old credential
  • Store the new one in the secrets manager

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A E C D B

  1. Create a second password (or user) alongside the current one Both are valid.
  2. Store the new one in the secrets manager As the current version.
  3. Roll services so they pick up the new secret Old instances still work on the old one.
  4. Confirm no connections use the old credential Check database logs.
  5. Revoke the old password Rotation complete.

30-second answer

Not in the repository, image or client app. Keep them in a secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager) and inject them at runtime through the platform's identity, so the app never holds a long-lived bootstrap secret. Grant each service only its own secrets, audit reads, and rotate on a schedule and on any suspicion, supporting two valid credentials at once so rotation needs no downtime. Prefer short-lived, dynamically issued credentials where you can.

Practise saying it · 30 s. No recording, just a timer

Where do secrets live?

Say your answer out loud, then check which of these points you covered:

  • Secrets manager
  • Runtime injection via identity
  • Least privilege, audit
  • Overlap rotation
  • Scan for leaks

Deep dive

Scan commits and CI logs for secrets (gitleaks, GitHub secret scanning).

Environment variables are fine as a delivery mechanism but leak via crash dumps and child processes; mount files or fetch at startup where possible.

Encrypt with envelope encryption: a KMS key wraps data keys.

A leaked secret in git history stays leaked; rotate it, don't just delete the commit.

Common mistakes

  • Secrets in .env files committed to git.
  • One shared admin credential for all services.
  • Rotation that needs a coordinated restart of everything.

Senior take & follow-ups

Secrets manager, runtime injection via identity, least privilege, overlap rotation, scanning.

Follow-up questions

Think of your answer first, then open the hint.

  1. A key was pushed to a public repo. First step?

    Show hint

    Revoke and rotate it immediately, then clean history.

  2. Why two valid credentials during rotation?

    Show hint

    Old instances keep working while new ones pick up the new secret.

Related questions

Suggest a fix if something here is wrong or out of date.