An application needs a database password.
Do not leave the plaintext password in source code or public logs.
Which countermeasure is appropriate?
Store secrets in a dedicated protected service or configuration and inject them only when the application needs them.
Detailed explanation
Correct. A protected store and controlled access avoid embedding the secret in source or images.
Incorrect. A plaintext commit can leak through the repository and its history.
Incorrect. Always displaying a secret expands its exposure.
Incorrect. Reusing one administrator password increases the blast radius of a compromise.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'secrets are injected at runtime, not committed to source'Expected result
secrets are injected at runtime, not committed to sourceKey points
- Secret management
- Runtime injection
- Log leakage
Notes
- Environment: クラウド秘密情報管理の概念確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Secret lifecycle
Manage secret generation, storage, injection, rotation, and revocation as one lifecycle.
Logging
Keep passwords and tokens out of application and operational logs.