Table of Contents
7. Handling Secrets — Keys, Tokens, and Environment Boundaries
Secrets are high‑value, high‑risk pieces of information that must be protected with clear boundaries.
Secrets are not configuration, settings, or code.
They include:
- API keys
- encryption keys
- signing keys
- database credentials
- access tokens
- webhook secrets
- private certificates
A secure system treats secrets as volatile, sensitive, and external.
This page introduces the mental model for handling secrets safely in modern PHP.
1. Secrets Must Never Live in Code
A secret in code is a secret in:
- version control
- forks
- backups
- logs
- deployments
- developer machines
- CI pipelines
Once a secret enters the codebase,
it becomes permanent.
A secure system keeps secrets outside the repository.
2. Use Environment Variables as the First Boundary
Environment variables are the simplest, safest default boundary.
They:
- are not stored in the repo
- differ per environment
- can be rotated easily
- can be injected securely by the platform
- avoid accidental exposure
In PHP:
$dbPassword = getenv('DB_PASSWORD');
Environment variables are not perfect — but they are the correct starting point.
3. Use a Secrets Manager for High‑Value Keys
For sensitive or long‑lived secrets,
environment variables are not enough.
Use a secrets manager:
- AWS Secrets Manager
- Azure Key Vault
- HashiCorp Vault
- GCP Secret Manager
A secrets manager provides:
- encryption at rest
- access control
- audit logs
- rotation policies
- temporary credentials
Secrets managers turn secrets into managed resources,
not static strings.
4. Never Log Secrets — Even by Accident
Secrets leak through:
- stack traces
- var_dump
- debug logs
- error handlers
- exception messages
- HTTP logs
- CLI output
A secure system:
- redacts sensitive fields
- avoids dumping entire objects
- sanitizes logs
- treats logs as hostile territory
If a secret appears in a log, assume it is compromised.
5. Rotate Secrets Regularly
Secrets age.
People leave teams.
Machines get cloned.
Backups get copied.
Rotation is not optional
— it is a hygiene practice.
A secure system:
- rotates secrets on a schedule
- rotates secrets on suspicion
- rotates secrets on incident
- rotates secrets when roles change
Rotation reduces the blast radius of compromise.
6. Use Short‑Lived Tokens Whenever Possible
Long‑lived secrets are dangerous.
Prefer:
- short‑lived access tokens
- temporary credentials
- expiring session tokens
- renewable leases
Short‑lived tokens reduce:
- exposure
- misuse
- replay attacks
- long‑term compromise
A token that expires
is a token that protects you.
7. Separate Secrets by Environment
Never reuse secrets across:
- development
- staging
- production
- CI
- local machines
Each environment is a different trust boundary.
Production secrets must never appear on a developer laptop.
8. Avoid Passing Secrets Through the Browser
Do not send secrets to the browser:
- no API keys
- no tokens
- no credentials
- no private URLs
If the browser needs access, use:
- signed URLs
- scoped tokens
- proxy endpoints
- capability‑based APIs
The browser is not a secure environment.
9. Encrypt Secrets at Rest When Possible
Even environment variables can leak through:
- process dumps
- container introspection
- misconfigured tooling
A secure system encrypts secrets at rest:
- in configuration stores
- in secrets managers
- in databases
- in filesystems
Encryption is not a substitute for boundaries
— it is a reinforcement.
10. Treat Secrets as a Lifecycle, Not a Value
A secret is not a string.
It is a lifecycle:
- creation
- distribution
- storage
- access
- rotation
- revocation
- destruction
Security comes from managing the lifecycle,
not the value.
Summary
Handling secrets safely is about boundaries, not cleverness.
A secure system:
- keeps secrets out of code
- uses environment variables as a baseline
- uses secrets managers for high‑value keys
- never logs secrets
- rotates secrets regularly
- prefers short‑lived tokens
- separates secrets by environment
- avoids exposing secrets to the browser
- encrypts secrets at rest
- treats secrets as a lifecycle
Secrets are the heart of the system.
Protect them with intention.
This page describes secure defaults and common practices in modern PHP. It is not a complete security guide, and it does not replace formal audits or framework‑specific documentation. These principles are consistent enough to be useful, but security always requires context, judgment, and ongoing review.