Security: credentials
This course covers where a Rails application keeps its secrets, using a repository that splits them between encrypted credentials and environment variables. It explains how credentials.yml.enc and the master key work, including per-environment files. It also shows how environment variables reach the process through Kamal and where they get exposed. It gives a rule for choosing between the two and a procedure for rotation and for responding to a leak. It then follows a secret through CI, build and deploy, and closes with a credentials plan for the repository.
What you'll learn
- ✓How Rails encrypted credentials and the master key work
- ✓How environment variables reach a process and where they are exposed
- ✓A rule for choosing between credentials and environment variables
- ✓Rotating secrets and responding to a leak
- ✓Handling secrets safely in CI, build, deploy and runtime
- ✓Writing a credentials plan for a repository
Where this app keeps its secrets
Every application has a handful of values that are not code and must not be public. A database password, an API key, the token that signs its cookies. This course is about where they live, and this repository is unusually interesting because it uses two mechanisms at once.
Read the full lesson free →Curriculum
7 lessonsWhere this app keeps its secrets
Maps where this repository keeps secrets, checks that master.key was never committed, and separates public keys from secrets.
Encrypted credentials, precisely
Explains how Rails encrypted credentials work, including per-environment files, key distribution, unreadable diffs and the cost of losing the key.
Environment variables, precisely
Covers how environment variables reach the process through Kamal, four ways they leak, the .env trap and ENV.fetch.
Choosing between them
Gives a rule for placing each secret in credentials or the environment, and weighs adopting a secret manager.
Rotation, and after a leak
Shows how to rotate each kind of secret, the order of steps after a leak, and leak detection controls.
Secrets in the pipeline
Follows a secret through CI, build, deploy and runtime, with the safe mechanism at each step and the bootstrapping problem.
Putting it together: a credentials plan
Audits this repository's secrets and adds four practices: a written rule, a .env.example, a rotation schedule and a scanner.