Secrets Management in DevSecOps: Vault, Rotation & Zero Hardcoded Credentials

The Hardcoded Secrets Epidemic

Secrets — API keys, database passwords, tokens, private keys, certificates — are the keys to your kingdom. And they're everywhere they shouldn't be.

GitGuardian 2025 State of Secrets Sprawl: Analyzed 1.5 billion git commits and found 12.8 million new secret occurrences in public repositories in 2024 alone — a 28% increase over 2023. One in every 400 commits contains at least one hardcoded secret.

---

Types of Secrets and Where They Leak

---

Secrets Detection

Pre-Commit Detection (Prevent Leaks)

# Install gitleaks as pre-commit hook
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

# Alternatively, install gitleaks globally
brew install gitleaks

# Scan entire repository history
gitleaks detect --source . --verbose

# Scan only staged changes (fast, for pre-commit)
gitleaks protect --staged --verbose

CI/CD Detection (Catch What Slipped Through)

# GitHub Actions — Block PRs with secrets
name: Secrets Detection
on: [pull_request]

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Secrets Detection Tools Comparison

---

Secrets Management Solutions

HashiCorp Vault

// Node.js — Fetching secrets from HashiCorp Vault
import Vault from "node-vault";

const vault = Vault({
  apiVersion: "v1",
  endpoint: process.env.VAULT_ADDR,
  token: process.env.VAULT_TOKEN, // Use AppRole in production
});

async function getDatabaseCredentials() {
  // Dynamic secret — Vault generates temporary credentials
  const result = await vault.read("database/creds/myapp-readonly");

  return {
    username: result.data.username,    // Temporary username
    password: result.data.password,    // Temporary password
    ttl: result.lease_duration,         // Expires in seconds
    leaseId: result.lease_id,          // For renewal/revocation
  };
}

AWS Secrets Manager

import {
  SecretsManagerClient,
  GetSecretValueCommand,
} from "@aws-sdk/client-secrets-manager";

const client = new SecretsManagerClient({ region: "us-east-1" });

async function getSecret(secretName: string): Promise<Record<string, string>> {
  const command = new GetSecretValueCommand({ SecretId: secretName });
  const response = await client.send(command);

  if (response.SecretString) {
    return JSON.parse(response.SecretString);
  }
  throw new Error("Secret not found");
}

// Usage
const dbConfig = await getSecret("prod/database/credentials");
// dbConfig = { host: "...", username: "...", password: "..." }

Solution Comparison

---

Automated Secret Rotation

Why Rotation Matters

• Limits blast radius — If a secret is leaked, it's only valid until the next rotation
• Compliance requirement — PCI-DSS, SOC 2, HIPAA all require credential rotation
• Reduces insider risk — Former employees' knowledge of secrets becomes useless

Rotation Schedules

---

CI/CD Secrets Security

---

Zero Hardcoded Credentials Maturity Model

---

Further Reading

• DevSecOps Complete Guide — Comprehensive DevSecOps implementation
• Shift-Left Security — Security in the SDLC
• GitGuardian (2025), "State of Secrets Sprawl" — Secrets leak statistics
• HashiCorp Vault Documentation — Vault reference
• Verizon (2025), "Data Breach Investigations Report (DBIR)" — Credential breach statistics