Secrets Management
Secrets management is the centralized storage, delivery, rotation and audit of the credentials that applications and infrastructure use, such as API keys, database passwords, tokens and private keys, so that they are not hard-coded in source, config files or CI pipelines. Secrets management tools such as HashiCorp Vault also issue short-lived dynamic credentials on demand instead of storing long-lived static ones.
| Secrets management | What it is not |
|---|---|
| Credentials used by software and pipelines | A password manager for people |
| Delivery at runtime, rotation and dynamic credentials | Secrets scanning, which finds secrets that already leaked |
| One part of machine identity | A replacement for workload identity, which removes the secret entirely |
The measure of a secrets program is not how many secrets are in the vault but how many exist outside it, and the winning move is issuing short-lived dynamic credentials so there is nothing durable to steal. Vaulting a static database password improves auditability; generating a 15-minute one on demand removes the asset. Most incidents still start with a credential in a repository, not in a vault.
See also: what is secrets management, secrets rotation, workload identity, secrets vendors, open source secrets management, HashiCorp Vault alternatives
Related on Start with Identity
- GlossaryCertificate Lifecycle Management (CLM)
Certificate lifecycle management (CLM), often called certificate management, is the practice of discovering, issuing, renewing, and revoking X.509 certificates,
- GlossaryConsent Management
Consent management is the capture, storage and enforcement of a user's consent to specific data processing and communications, with a record of what they were s
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- GlossaryUser Lifecycle Management
User lifecycle management is the automated creation, change and removal of a person's accounts and access as their relationship with an organization changes, dr
- CVEVault certificate-auth impersonation, public key not CN
Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key im
- CVEVault login MFA rate-limit bypass and TOTP reuse
Vault's login MFA rate limits could be bypassed and TOTP codes reused, weakening the second factor. Part of the 2025 VaultFault set with the LDAP MFA bypass in