secrets-management

Secrets management principles for Node, container and AI-agent stacks - classifying secrets, using a dedicated secret store or manager, runtime injection instead of build-time baking, rotation, least privilege, short-lived and federated credentials, keeping secrets out of git, images, logs and error output, secret scanning and pre-commit detection, incident response for a leaked secret (revoke first, then clean up), access auditing, and handling API keys for AI agents and CI. Load when adding credentials or API keys, wiring secrets into deployments or CI, setting up secret scanning, or responding to a suspected leak.