How do you handle secrets in CI/CD pipelines?
⚡
Quick Answer
Never hard-code secrets. Inject them at runtime from a secrets manager (Vault, cloud secret stores) or the CI platform encrypted secret store, scope them tightly, mask them in logs, and rotate them regularly.
Detailed Answer
Prefer short-lived, dynamically issued credentials and OIDC federation (e.g., GitHub Actions assuming an AWS role with no stored keys) over long-lived secrets. Restrict which jobs/branches can access which secrets, avoid exposing them to PRs from forks, and audit access. Leaked pipeline secrets are a top real-world breach vector.
💡
Interview Tip
Bring up OIDC/keyless auth (no stored cloud keys) — it is the modern best practice and stands out.
secretsci-cdsecurity