Secrets Don’t Belong in Config
Summary
The article argues that secrets such as passwords and API keys should not be embedded in application configuration. It analyzes how secrets leak or get mishandled in deployment tooling (NixOS, Helm, CI), advocates for dedicated secret interfaces and runtime channels, and presents SecretSpec as a cross-language approach to declare what an app needs while allowing secret values to be supplied by external providers. The piece emphasizes practical patterns to decouple secrets from configuration, improving security and portability across development, CI, and production environments.