secret-hygienelisted

# Secret Hygiene A practical workflow for credential management: detecting leaks, rotating cleanly, and preventing recurrence. ## When to invoke - A secret was committed to git, or a private repo went public - A contributor leaves the project, or access scope changes - A credential turned up in a public dump, paste, or leak feed - Periodic audit (quarterly is reasonable) - Onboarding a repo, hosting account, or VPS you inherited ## Step 1 — Inventory what you have You cannot rotate secrets you cannot enumerate. Build a list, even a rough one. ``` - Hosting panel: <provider> creds in: 1Password vault X - DB user: <name> creds in: server .env, 1Password - API keys: - Stripe live + test creds in: backend .env, Stripe dashboard - Mailgun creds in: backend .env - GitHub PAT creds in: ~/.gitconfig (BAD — move to keychain) - SSH keys: ~/.ssh/id_* on machines: workstation, CI, VPS - CI secrets: GitHub Actions visible at: repo/settings/secrets ``` Keep this in a password manager or a private repo — never in plaintext on disk. ## Step 2 — Scan for leaks (local + repos) ### Local filesystem ```bash # Files commonly containing secrets find ~/Code -maxdepth 4 -type f \( -name '.env*' -o -name 'credentials*' -o -name 'secrets*' \) -not -path '*/node_modules/*' 2>/dev/null # Permissions check — .env should be 600 find ~/Code -name '.env*' -not -path '*/node_modules/*' -exec stat -f '%Lp %N' {} \; 2>/