Secrets

Where should production secrets live?

Whether the candidate reasons about the whole lifecycle — issuance, delivery, rotation, revocation, audit — rather than about where to hide a string.

The situation behind the question

A service reads its database password from an environment variable set in the deployment manifest, which is committed to the repository. The same password is used in staging, is known to the whole team, and was last changed when the service launched.