Developers discover API keys and database passwords checked into a municipal Git repository. What is the recommended remediation pattern for ongoing secret handling?
Select an answer to reveal the explanation.
Short Explanation
Git is a history book, not a lockbox—once a password lands there, assume it has been photocopied. Move keys into a secrets manager, rotate what leaked, and keep credentials out of the repo. Emailing secrets or pasting them into browser JavaScript just spreads the problem.
Full Explanation
Secrets management best practice keeps API keys, database passwords, and similar credentials out of source control and client-side code, placing them in a dedicated secrets manager with controlled retrieval and rotation. Committing more secrets, emailing plaintext credentials, or embedding long-lived keys in JavaScript expands exposure. Cloud+ security objectives include proper secrets handling for cloud applications and automation.