Avoid having secrets if you can. Use authentication methods that don’t require them. When they are required rotate them often - ideally automated. Keep them out

Avoid having secrets if you can. Use authentication methods that don’t require them. When they are required rotate them often - ideally automated. Keep them out of password managers. They are like condoms: cheap enough to use once, unpleasant if used twice. Hence the common UX where you get to see the key once encourages using once. Give those tokens the minimum permissions possible. Make sure the impact of needing to rotate that secret doesn’t mean other secrets are exposed (looking at you: azure storage account primary access key!) Automated rotations make keeping them up to date in git untenable anyway. Some services like Vercel and Firebase encourage bad practices in this regard. Firebase requires you to download a plaintext JSON of kingdom keys in order to do anything useful! Vercel KV storage encourages you to run an SDK command to download prod secrets into a local env file.