DevSecOps › Module 4 › Lesson 3
Secret Hygiene
Secret hygiene literacy names vault usage, rotation, environment separation, and never-commit rules — document secret lifecycle on YOUR $DEVSEC_LAB before CI deploy.
Visual · t36_secret_hygiene
Secret hygiene literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Secrets belong in vaults, not repos — literacy teaches hygiene lifecycle so credentials stay out of Git on projects you own.
Secret hygiene covers never committing credentials, using GitHub encrypted secrets or vault references in CI, rotating on exposure, separating dev/staging/prod secrets on YOUR lab apps, and scanning logs for accidental leaks.env files stay gitignored; lab uses.env.example with placeholders only. Cyberlium writes secret hygiene row on YOUR $DEVSEC_LAB — storage location, rotation trigger, env separation for one fictional app. Next: SAST Lab.
1. Secret hygiene components (named)
Storage: GitHub encrypted secrets, vault OIDC, never plain text in repo on YOUR project. Rotation: on leak, quarterly for long-lived keys, automated where supported. Separation: dev lab secrets ≠ staging ≠ prod — fictional labels on $DEVSEC_LAB. Prevention: gitignore.env, pre-commit Gitleaks, log masking in CI.
On $DEVSEC_LAB, write hygiene row — secret name placeholder, storage, rotation rule for fictional app.
Command guide
Try these commands — Secret hygiene components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Bridgecrew Checkov — https://www.checkov.io/ Checkov CLI — https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html NIST SSDF — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install checkov
macOS:
Command — copy this
pipx install checkov
Windows:
Command — copy this
pip install checkov
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_IAC=${DEVSEC_IAC:-$DEVSEC_LAB/iac}
echo '=== checkov scan on YOUR iac/main.tf (optional if installed) ==='
if command -v checkov >/dev/null; then checkov -f "$DEVSEC_IAC/main.tf" --compact 2>&1 | head -40; else cat > "$DEVSEC_LAB/notes/checkov-fallback.md" <<'EOF'
# Checkov Fallback — tool not installed
Install: pip install checkov OR https://www.checkov.io/2.Basics/Installing%20Checkov.html
Then run: checkov -f $HOME/cyberlium-lab/t36-devsec/iac/main.tf --compact
Expected findings (intentional lab misconfigs):
- S3 public access block disabled
- Security group SSH open to 0.0.0.0/0
Document CKV_* IDs in findings/ — never scan stranger cloud accounts
EOFCommand — copy this
grep -E 'S3|0.0.0.0/0|stranger' "$DEVSEC_LAB/notes/checkov-fallback.md"; fi grep MISCONFIG "$DEVSEC_IAC/main.tf"
Primary tools to practice this lesson: checkov, grep. Reference sites: Bridgecrew Checkov (https://www.checkov.io/); Checkov CLI (https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html); NIST SSDF (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why hygiene beats post-incident rotation alone
One committed PAT grants repo access until revoked. Shared prod secrets in dev configs cause cross-environment bleed. Lab hygiene habits prevent expensive incidents before employer production exposure.
Students document lab secret lifecycle on notes — production follows vault SLAs and audit requirements.
3. Lab boundary
Forbidden: storing live production secrets in lab notes or committing real keys for 'realism.' Allowed: secret hygiene card — lifecycle with $DEVSEC_LAB placeholder secrets only.
Ship: secret hygiene card for YOUR lab app. Next: SAST Lab.
4. What you ship: secret hygiene card for $DEVSEC_LAB
Storage, rotation, env separation rules. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Secret hygiene card. $DEVSEC_LAB named. File t36-m04-l03-secret-hygiene.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Commit.env with real API keys. Reuse prod secret in lab because 'easier.'
Right
Write secret hygiene card for YOUR $DEVSEC_LAB. Next: SAST Lab.
Mission: document secret lifecycle on YOUR lab
1) Define storage and rotation rules. 2) Write env separation for dev lab app. 3) Confirm.env.example uses placeholders only. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Placeholder secrets in lab — rotate immediately if anything real slips in.
Knowledge Check
APPLY: Secret hygiene primarily requires:
Multiple choice
Knowledge Check
APPLY: True or False: Lab apps should use separate secrets from production.
True or False
Knowledge Check
APPLY: Secret hygiene literacy on Cyberlium uses:
Multiple choice