secrets-management
Safeguard articles tagged "secrets-management" — guides, analysis, and best practices for software supply chain and application security.
102 articles
How to secure Kubernetes secrets and sensitive data
Kubernetes secrets are base64, not encrypted, by default. Here's how they actually leak, where Prisma Cloud's CNAPP approach falls short, and how to fix rotation, RBAC, and encryption gaps.
What Is a PAT Token and How Do You Keep It Secure?
A PAT token is a personal access token that stands in for your password when scripts and tools talk to services like GitHub. Here's how it works and how to stop it leaking.
How to Secure a GitLab Personal Access Token (and Avoid Leaks)
A GitLab personal access token is a password-equivalent credential for the API and Git over HTTPS. Here is how to scope, rotate, and store one without turning it into a breach.
What Are Hardcoded Credentials
Hardcoded credentials are secrets baked into code instead of a vault. Toyota, Uber, and Samsung breaches show why that risk never expires on its own.
What is Sensitive Data Exposure
Sensitive data exposure covers everything from unencrypted databases to hardcoded secrets. Learn what causes it, real breach examples, and how to detect it early.
How to Rotate Leaked CI Secrets Without Downtime
A leaked CI credential does not have to mean an outage. The dual-credential pattern: issue new alongside old, cut over, verify with usage logs, then revoke — plus what to do after.
Doppler Enterprise Secrets Platform Reviewed
Doppler pitches itself as the secrets platform that gets out of developers' way. A detailed look at what works, what does not, and the trade-offs against Vault, Infisical, and the cloud-native options.
OAuth vs API Keys
OAuth and API keys aren't interchangeable: one is a static, long-lived credential, the other a scoped, expiring token. Here's how to choose, backed by real breaches.
Azure Key Vault Rotation Patterns
Rotation is the Key Vault feature most teams nominally have and few actually operate. A walk through the patterns that work for secrets, keys, and certificates at scale.
Secrets sprawl
What is secrets sprawl? A plain-English breakdown of how API keys and credentials scatter across codebases, and what to do about it.
Kubernetes Secrets Management: Vault, Sealed Secrets, SOPS, and External Secrets Compared
Kubernetes Secrets are base64-encoded, not encrypted. That is the start of the problem. Here is a no-nonsense comparison of the tools that actually solve secrets management in Kubernetes.
How to set up HashiCorp Vault for secrets management
A step-by-step guide to set up HashiCorp Vault for secrets management, covering installation, dynamic secrets, Kubernetes integration, and verification steps.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.