Skip to content

Secrets & Credentials

This portal documents where secrets live and how they are referenced. It must never contain secret values.

Secret-location map

Secret class Approved location Repository content may contain
CI/CD credentials GitHub repository/environment Secrets Secret name only
Non-sensitive CI configuration GitHub Actions Variables or checked-in config Public identifiers/defaults only
Cloudflare deployment credentials GitHub Secrets and/or Cloudflare dashboard secret bindings Binding/secret name only
Kubernetes runtime secrets Namespace-scoped Kubernetes Secret such as akshayabazaar-<env>-secrets Secret object name/key names; never decoded values
Terraform provider credentials Operator environment, CI secret store, or ignored .tfvars/environment input Variable names and examples with placeholders
Local developer credentials ignored .env / user-secret mechanism / local secret store .env.example placeholders only
Database credentials Runtime secret store / Kubernetes Secret / approved server configuration Host/port documentation only when non-sensitive; password never
Razorpay / payment credentials Runtime secret store / CI secret store Key/binding names only; never secret/signature values
SSH private keys User/agent secure key store Public-key location or key identifier only

Common placeholder convention

Documentation and examples use placeholders:

<CLOUDFLARE_API_TOKEN>
<HETZNER_TOKEN>
<MYSQL_PASSWORD>
<REDIS_PASSWORD>
<RAZORPAY_KEY_SECRET>
<SSH_KEY_PATH>

A placeholder is not permission to store the real value next to it.

GitHub Actions

Before changing a workflow, inspect which names it references under secrets.* and vars.*. Configure those names in:

GitHub repository
→ Settings
→ Secrets and variables
→ Actions

Use Secrets for credentials/tokens and Variables only for values safe to expose in logs/build metadata.

Never echo a secret for troubleshooting. Confirm presence using workflow configuration or a boolean/masked diagnostic instead.

Cloudflare

Cloudflare Pages/Workers runtime and deployment secrets belong in the Cloudflare project/Worker settings or an approved CI secret store. Documentation may record:

  • account/project name,
  • binding name,
  • D1/R2 resource name,
  • environment variable name,
  • whether the value is secret or non-secret.

Documentation must not record token strings, API keys, JWT signing material, D1 credentials, payment secrets, or generated one-time values.

Kubernetes

List secret metadata without decoding it:

kubectl get secret -n <namespace>
kubectl describe secret akshayabazaar-<env>-secrets -n <namespace>

Do not run/publish commands that base64-decode secret values as routine documentation.

For a deployment, verify the referenced Secret exists before Helm upgrade:

kubectl get secret akshayabazaar-<env>-secrets -n <namespace>

Terraform

Provider credentials must enter Terraform through environment/CI secret injection or an ignored secure variable file. Before committing:

git status
git diff --check
git grep -n -E "(token|password|secret|private[_-]?key)" -- ':!*.lock.hcl'

Every hit requires review; variable names are expected, values are not.

Never commit:

*.tfstate
*.tfstate.*
terraform.tfvars containing credentials
.env
private keys
cloud provider tokens
kubeconfig containing credentials

Rotation procedure

  1. Identify every runtime/CI location using the credential.
  2. Create/rotate the credential at the provider.
  3. Update the secret store without committing the value.
  4. Redeploy/restart only the consumers that require it.
  5. Verify application and CI health.
  6. Revoke the old credential after successful verification.
  7. Record the rotation date and secret name, not the value.

If a secret is exposed

Treat accidental exposure as compromised even if quickly deleted.

  1. Revoke/rotate it immediately.
  2. Remove it from the current branch/file.
  3. Determine whether Git history/artifacts/logs also contain it.
  4. Replace affected credentials and redeploy consumers.
  5. Document the incident without reproducing the secret.