Dependency and Secret Management
Reduce supply-chain and credential-leak risks during development and operations.
Recommended approach
- Keep dependency updates regular and automated.
- Store secrets in managed secret stores, not source code.
- Rotate credentials on schedule and after incidents.
Alternatives and when to choose them
- Centralized platform-managed secrets for multi-service orgs.
- Repo-level encrypted secrets for small projects.
Implementation checklist
- Enable dependency scanning and update bots.
- Add pre-commit/CI secret scanning.
- Document secret ownership and rotation cadence.
Common pitfalls
- Long-lived credentials shared across environments.
- Blindly auto-upgrading major dependencies without rollout controls.