What counts as a secret

Credentials, tokens, keys — and what is not one.

In short. A secret is any value whose power comes from staying unknown: database passwords, API tokens, cloud access keys, TLS private keys, signing keys, session cookies that act as bearer credentials.

A secret is any value whose power comes from staying unknown: database passwords, API tokens, cloud access keys, TLS private keys, signing keys, session cookies that act as bearer credentials. If presenting the string is enough to act as someone or something, it is a secret — whether or not your wiki calls it one.

Teams muddy the water by calling everything sensitive a secret. Customer PII is sensitive and must be protected, but it is not usually a credential. A public TLS certificate is not a secret; its private key is. An AWS access key ID starting with AKIA is an identifier that often travels with a secret access key — scanners flag both because the pair is dangerous together.

This course starts here on purpose. Before you pick Vault, SOPS, or a cloud manager, you need a shared vocabulary for what you are protecting, how it leaks, and what "rotate" actually means. Vague language produces vague controls.

Credentials, secrets, and tokens

A credential proves identity or authorization. A secret is a credential (or key) that must remain confidential. A token is typically a machine-issued secret with a recognizable format and often an expiry — ghp_ GitHub PATs, JWT access tokens, Vault tokens starting with hvs.. Short-lived tokens are still secrets for their lifetime; expiry reduces blast radius but does not make logging them safe.

# recognizable prefixes help scanners — and attackers
grep -RInE 'AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|hvs\.[A-Za-z0-9]+' . 2>/dev/null | head

./old-deploy.sh:12:AWS_ACCESS_KEY_ID=AKIA...
./notes.md:4:ghp_...redacted...
# SUCCESS — prefixes are a clue, not a complete detector

What people mis-label

Base64 is encoding, not encryption. "Private" git repos are access-controlled, not encrypted. Kubernetes Secret objects are not encrypted by default. Environment variables are not a vault. Understanding those myths is the rest of this course in miniature.

Going deeper

Bearer tokens deserve special care because possession equals authorization — there is no second factor at use time. Session cookies, Vault tokens, cloud temporary credentials, and many SaaS PATs fall in this class. Logging them is functionally publishing access.

Derived secrets matter too: OAuth refresh tokens, backup codes, and encryption passphrases. Inventory them when you build a secrets program or you will rotate the access token and leave the refresh token alive in a mobile app.

Write a one-page standard for your org: what must live in a manager, what may be in CI OIDC sessions, what is forbidden in git, and how long each class may live. Without that standard, every team invents a weaker one.

Try this

List three values your app needs at boot and classify each as secret, sensitive-non-secret, or public. Note where each currently lives.

printf '%s\n' 'DB_PASSWORD — secret' 'STRIPE_PUBLISHABLE_KEY — public-ish id' 'CUSTOMER_EMAIL — sensitive PII' 'TLS_CERT_PEM — public cert' 'TLS_KEY_PEM — secret'

DB_PASSWORD — secret
STRIPE_PUBLISHABLE_KEY — public-ish id
CUSTOMER_EMAIL — sensitive PII
TLS_CERT_PEM — public cert
TLS_KEY_PEM — secret

Takeaway

Secrets are values that grant power through confidentiality. Name them precisely so controls match risk — and do not confuse sensitive data with credentials.

Next: how those secrets actually leak in the wild — logs, process listings, dumps, and repos.

Related