env-secrets-manager

1. Secret manager is source of truth — .env files are for local dev only; never in prod 2. Rotate on a schedule, not just after incidents — quarterly minimum for long-lived keys 3. Principle of least privilege — each service gets its own API key with minimal permissions 4. Audit access — log every secret read in Vault/SSM; alert on anomalous access 5. Never log secrets — add log scrubbing middleware that redacts known secret patterns 6. Use short-lived credentials — prefer OIDC/instance roles over long-lived access keys 7. Separate secrets per environment — never share a key between dev and prod 8. Document rotation runbooks — before an incident, not during one