Platform & DevOps·Secrets, identity and the supply chain
the database password is fetched at start-up from a service that logs who asked, instead of sitting in the repository.
Secret management
Also calledsecrets manager, vault, credential storage
Storing credentials in a dedicated system with access control, audit and rotation, and delivering them to workloads at run time. The delivery mechanism matters as much as the store: an environment variable is visible to anything that can read the process, and a mounted file at least can be refreshed in place. The hard part is never the storage — it is that the workload must authenticate to the secret store somehow, which is what workload identity exists to solve.