https://securoxen.io/assets/secrets-in-environment-variables-BpX54Rks.js

1import{j as e}from"./index-0qbe4j-K.js";import{P as s}from"./prose-CP3GO64z.js";import{L as t}from"./react-vendor-CuqwDvgQ.js";function o(){return e.jsxs(s,{children:[e.jsx("p",{children:'"Move it to an environment variable" is the standard answer to a hardcoded secret, and it is a real improvement - the value leaves the repository. It is worth knowing what it does not do, because a lot of teams stop there and believe the problem is solved.'}),e.jsx("h3",{children:"What it fixes"}),e.jsx("p",{children:"The secret is out of version control, so it is not in the diff, the clone, or the fork - and it can differ per environment without a code change. That is genuinely most of the value."}),e.jsx("h3",{children:"Where it still leaks"}),e.jsxs("ul",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Child processes."})," Environment is inherited. Every subprocess your app spawns gets the whole set, including tools that log their environment on startup."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Crash reports."})," Error reporters frequently capture environment as context. The secret then travels to a third party with the stack trace, exactly as in"," ",e.jsx(t,{to:"/learn/what-a-stack-trace-gives-away",children:"what a stack trace gives away"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"CI logs."})," A shell trace, a debug flag, or an ",e.jsx("code",{children:"echo"})," that seemed harmless prints the value into a build log that may be public and is certainly retained."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Process listings."})," On some systems another local user can read a process's environment. Passing a secret as a command-line argument is worse still - it is visible in the process table to everyone."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"The .env file itself."})," It lives on disk, usually at ",e.jsx("code",{children:"644"}),", and gets copied into images and backups. Check with the"," ",e.jsx(t,{to:"/tools/chmod-calculator",children:"chmod Calculator"}),"; the reasoning is in"," ",e.jsx(t,{to:"/learn/what-file-permissions-actually-mean",children:"what file permissions actually mean"}),"."]})]}),e.jsx("h3",{children:"They are not rotatable in practice"}),e.jsx("p",{children:"Rotating an environment variable means redeploying. So rotation becomes an event rather than a routine, which means it does not happen on a schedule - it happens after an incident, when it is a recovery step rather than a precaution."}),e.jsx("p",{children:"A secrets manager fetching at runtime with a short lease turns rotation into something that happens without anyone deciding to do it. That is the real upgrade over environment variables, and it matters more than the storage question."}),e.jsx("h3",{children:"What to do this week"}),e.jsxs("ol",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Check what is already committed."})," Environment variables today do not remove the value from history. Scan with the"," ",e.jsx(t,{to:"/tools/repo-secret-scanner",children:"Repo Secret Scanner"}),", and if you find something, rotate before you tidy - the order is in"," ",e.jsx(t,{to:"/learn/the-first-hour-of-an-incident",children:"the first hour of an incident"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Commit a .env.example."})," Real values in the deployment platform, key names in the repository, so nobody has to guess and nobody is tempted to paste a real one."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Fix the permissions."})," ",e.jsx("code",{children:"600"})," on anything holding a secret."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Redact before sharing."})," Configs get pasted into tickets constantly - run them through ",e.jsx(t,{to:"/tools/scrub-for-ai",children:"Scrub for AI"})," first."]})]})]})}export{o as default};