Every .env file in my projects is gone and nothing broke
A local secrets file is a copy nobody controls. An encrypted vault that materializes per ecosystem removes the copy rather than protecting it.
secrets
6 posts
Where a secret lives should never be a decision
Six consumers each deciding where a keystore lives agree until one changes. One registry keyed by stack and category, one resolver, no direct reads.
Setting a secret on the repo is how it stops having an owner
A repo-side secret has no owner, no rotation path and no inventory. One vault, propagation outward, and a guard that refuses the paste.
Two prefixes decide who owns a credential
Whether a credential is organisation-wide or per-app has to be visible in its name, because the name is what every manifest and resolver decides from.
The command that leaked a secret was not on the list
A rule naming forbidden commands cannot hold, because any program that reads bytes can emit them. Enforcing a property of output needs an allowlist.
An auth gate you do not resent
A gate asked too often gets automated away, and one asked once never expires. Charge full authentication only for transitions that change the threat model.