Can you keep a secret?
summary
Median discovery time for leaked keys is 20 seconds and worst-case testing hit about four minutes, so assume immediate compromise. Practical fixes shown: keep credentials out of code using environment variables, use direnv-style per-directory loading, encrypt shared files with git-secret/PGP for development, rotate keys and use a KMS in production, block commits with git-secrets git hooks, and hunt past leaks with git-leaks. Demos include creating encrypted key files, automatic loading/unloading of vars, and hook-enforced failure so the workflow stays low-friction and actually adopted.
AI-written summary · about
chapters (15)
- 0:00CAN YOU KEEP A SECRET? @AARONBASSETT
- 8:16LOW FRICTION
- 8:29EASY TO IMPLEMENT
- 9:0012 FACTOR APPS
- 9:19III. CONFIG
- 12:34CREATING ENVIRONMENT VARIABLES
- 15:16SHARING SECRET FILES
- 15:30ENCRYPTION AT REST
- 15:49CLIENT-SIDE FIELD LEVEL ENCRYPTION
- 19:55GIT SECRETS
- 20:43PROVIDERS
- 22:29AUDIT GIT REPOS FOR SECRETS. GITZEAKS PROVIDES A WAY FOR YOU TO FIND UNENCRYPTED SECRETS AND OTHER UNWANTED DATA TYPES W GIT SOURCE CODE REPOSITORIES
- 23:26KEEP SECRETS AND CODE SEPARATE
- 23:38AUTOMATE, AUTOMATE, AUTOMATE
- 23:59LATE IS BETTER THAN NEVER
related talks
26mHow To Keep A Secret
26mSecret Hunting
24mHow to Find if Your Developers are Leaking Secrets?
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
48mHow Source Code is Revealing our Secrets
39mSecrets Management: How to (not) help the person who hacks your servers get your data
30mBehind Closed Doors: Managing Passwords in a Dangerous World
10mLightning Talk: How to Keep a Secret in GitOps, Without Keeping...