What you will learn
- Use encrypted secrets
- Mask values in logs
- Scope secrets tightly
New to this? Start here
The basics, in plain English
Pipelines often need passwords, tokens, or keys to deploy. These secrets must never be written in plain text in your code. Instead they are stored securely and injected only when needed.
- Secret
- A sensitive value like a password, API key, or token that must stay hidden.
- Hardcoding
- The dangerous mistake of typing a secret directly into your code or config.
- Secret store
- A secure vault that holds secrets and hands them out only to those allowed.
- Injection
- Supplying a secret to the pipeline at run time, never saving it in the repo.
- Rotation
- Regularly replacing secrets so an old leaked one becomes useless.
01
No plaintext
Store secrets in the CI provider vault, inject as masked env vars, and scope to specific environments. Never echo a secret.
Finished this topic?
Mark it done to earn 100 XP and keep your streak alive.