Day 26/30: Your database password is not source code

Passwords, API keys and tokens should not be hard-coded into applications or committed to Git.

AWS Secrets Manager can securely store and manage sensitive values. It can also support automated rotation for compatible services.

The application retrieves the secret when required instead of carrying it around in the code.

If your password is sitting in a repository called production-final-real, it is no longer much of a secret.

Protect credentials separately from the application.