What a secret is, and why secrets leak
Define the thing you are protecting, and learn the four ways credentials actually escape in practice.
A secret is any value whose confidentiality is what makes it useful. An API key, a database password, a private key, a session token. The moment someone else knows it, it stops working as a control. Crucially, it keeps working as a credential.
That asymmetry is the whole problem. A leaked password does not stop being valid. It stops being exclusive.
Three of the four properties below are the classic CIA triad: confidentiality, integrity and availability. Secrets management inverts the usual emphasis. Availability still matters, and a secret nobody can read is an outage, but the properties that dominate are confidentiality and two that the triad does not name at all: freshness and attribution.
- Confidentiality: only intended parties know the value.
- Integrity: the value has not been altered in transit or at rest.
- Freshness: the value is current, and old copies stop working.
- Attribution: you can tell who used it, and when.
Most real breaches are not broken cryptography. They are a valid credential in the wrong hands. Design for that case, because it is the likely one.
Credentials escape in four recognisable ways. Nearly every incident you will read about is one of these:
- Sprawl: the same key copied into a .env file, a CI variable, a Slack message, and someone's laptop. There is no single place to revoke it.
- Persistence: a key with no expiry stays valid for years, so a copy taken in 2023 still works today.
- Over-scope: a key that can do everything is used for one task, so any leak is a total loss rather than a partial one.
- Observability gaps: nobody can answer 'which service used this key last Tuesday', so a compromise goes unnoticed.
Notice that three of the four have nothing to do with encryption. They are lifecycle and scope problems. Encrypting a secret you never rotate and grant to everything is polishing the lock on an open door.
The rest of this track builds the tools that address each one: encryption for confidentiality at rest, signatures for integrity and attribution, short-lived credentials for freshness, and access-control models for scope.
Check your understanding
3 questionsWhy is a leaked credential more dangerous than a broken encryption algorithm in practice?
Which of the four leak modes does encryption at rest actually address?
A key is copied into a .env file, a CI secret, and a teammate's laptop. Which failure mode is this?