Definition
Secrets management encompasses practices for storing, injecting, rotating, and auditing API keys, tokens, and credentials in development and production systems — especially CI/CD pipelines and container builds.
Key Points
- 2026-09: baseten incident — admin GitHub PAT persisted in Docker image layers 3+ years; public Harbor registry amplified blast radius
- Use BuildKit secret mounts instead of ARG/ENV expansion in RUN commands
- Audit
docker history --no-truncon images; least-privilege expiring tokens - Rotate secrets even after registry privatization — token may still be valid