Skip to main content
Back to Playground
SecurityBeginner20 min

Security, Secrets & Responsible Ownership

API keys, credential management, and accountability frameworks. Learn to handle sensitive information responsibly.

Section 1 of 714% complete
What Are Secrets?

In software and systems, 'secrets' refers to any piece of sensitive information that grants access or proves identity. Unlike public information, secrets must be protected from unauthorised access.

Types of Secrets

  • **API Keys**: Tokens that identify your application to external services
  • **Database Credentials**: Username/password pairs for database access
  • **Encryption Keys**: Keys used to encrypt and decrypt data
  • **OAuth Tokens**: Authorisation tokens for third-party services
  • **SSH Keys**: Cryptographic keys for secure server access
  • **Signing Certificates**: Certificates that verify code or document authenticity

Sensitivity Levels

Not all secrets are equally sensitive:

  1. **Critical**: Production database credentials, payment API keys, master encryption keys
  2. **High**: Internal API keys, service account credentials
  3. **Medium**: Development environment credentials, test API keys
  4. **Low**: Public API keys with usage limits, read-only tokens

The Cost of Exposure

Exposed secrets can lead to: - Unauthorised data access - Financial fraud - Service disruption - Reputational damage - Legal liability - Regulatory fines