Which practice best prevents secrets leaking into source code in a Java/Spring project?
Options
- Use a secrets manager, scan commits, rotate leaks (Correct option)
- Commit them to application.properties in a private repo
- Encode them in base64 and keep them in the code
- Put them in comments next to the code they unlock
Answer
Load them from a secrets manager (Vault, AWS Secrets Manager, Azure Key Vault) or environment variables, scan commits for secrets, and rotate any leaked secret
Why
Private repositories still leak: former employees, forks, build logs, compromised accounts.
Good practice: secrets live outside the code (Vault, Key Vault, Secrets Manager, Kubernetes Secrets with encryption), loaded at runtime. Use pre-commit/CI secret scanning (gitleaks, GitHub secret scanning). Use workload identities where possible, so there is no secret at all.
If one leaks: revoke and rotate immediately; removing the commit does not remove history copies.
Remember
Secrets outside code, scanned, rotated, or replaced by workload identity.