What it means
A secrets service should limit exposure to authorized workloads and people, support short-lived credentials, separate environments, and provide evidence of access and change.
Why it matters
Poorly managed secrets are a common path from source code, logs, or pipeline compromise to privileged access across systems.
Practical focus
- Keep secrets out of source and build artifacts
- Use workload identity and short-lived credentials where possible
- Rotate and revoke automatically
- Detect exposed secrets and respond quickly
Common mistakes
- Storing encrypted secrets beside the decryption key
- Sharing one credential across environments
- Logging tokens during troubleshooting
- Rotating secrets without updating dependent systems safely
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: