Secrets & Credentials¶
This portal documents where secrets live and how they are referenced. It must never contain secret values.
Secret-location map¶
| Secret class | Approved location | Repository content may contain |
|---|---|---|
| CI/CD credentials | GitHub repository/environment Secrets | Secret name only |
| Non-sensitive CI configuration | GitHub Actions Variables or checked-in config | Public identifiers/defaults only |
| Cloudflare deployment credentials | GitHub Secrets and/or Cloudflare dashboard secret bindings | Binding/secret name only |
| Kubernetes runtime secrets | Namespace-scoped Kubernetes Secret such as akshayabazaar-<env>-secrets |
Secret object name/key names; never decoded values |
| Terraform provider credentials | Operator environment, CI secret store, or ignored .tfvars/environment input |
Variable names and examples with placeholders |
| Local developer credentials | ignored .env / user-secret mechanism / local secret store |
.env.example placeholders only |
| Database credentials | Runtime secret store / Kubernetes Secret / approved server configuration | Host/port documentation only when non-sensitive; password never |
| Razorpay / payment credentials | Runtime secret store / CI secret store | Key/binding names only; never secret/signature values |
| SSH private keys | User/agent secure key store | Public-key location or key identifier only |
Common placeholder convention¶
Documentation and examples use placeholders:
<CLOUDFLARE_API_TOKEN>
<HETZNER_TOKEN>
<MYSQL_PASSWORD>
<REDIS_PASSWORD>
<RAZORPAY_KEY_SECRET>
<SSH_KEY_PATH>
A placeholder is not permission to store the real value next to it.
GitHub Actions¶
Before changing a workflow, inspect which names it references under secrets.* and vars.*. Configure those names in:
Use Secrets for credentials/tokens and Variables only for values safe to expose in logs/build metadata.
Never echo a secret for troubleshooting. Confirm presence using workflow configuration or a boolean/masked diagnostic instead.
Cloudflare¶
Cloudflare Pages/Workers runtime and deployment secrets belong in the Cloudflare project/Worker settings or an approved CI secret store. Documentation may record:
- account/project name,
- binding name,
- D1/R2 resource name,
- environment variable name,
- whether the value is secret or non-secret.
Documentation must not record token strings, API keys, JWT signing material, D1 credentials, payment secrets, or generated one-time values.
Kubernetes¶
List secret metadata without decoding it:
kubectl get secret -n <namespace>
kubectl describe secret akshayabazaar-<env>-secrets -n <namespace>
Do not run/publish commands that base64-decode secret values as routine documentation.
For a deployment, verify the referenced Secret exists before Helm upgrade:
Terraform¶
Provider credentials must enter Terraform through environment/CI secret injection or an ignored secure variable file. Before committing:
git status
git diff --check
git grep -n -E "(token|password|secret|private[_-]?key)" -- ':!*.lock.hcl'
Every hit requires review; variable names are expected, values are not.
Never commit:
*.tfstate
*.tfstate.*
terraform.tfvars containing credentials
.env
private keys
cloud provider tokens
kubeconfig containing credentials
Rotation procedure¶
- Identify every runtime/CI location using the credential.
- Create/rotate the credential at the provider.
- Update the secret store without committing the value.
- Redeploy/restart only the consumers that require it.
- Verify application and CI health.
- Revoke the old credential after successful verification.
- Record the rotation date and secret name, not the value.
If a secret is exposed¶
Treat accidental exposure as compromised even if quickly deleted.
- Revoke/rotate it immediately.
- Remove it from the current branch/file.
- Determine whether Git history/artifacts/logs also contain it.
- Replace affected credentials and redeploy consumers.
- Document the incident without reproducing the secret.