Secrets Management and Team Security

API keys, database credentials, Stripe keys, and OAuth secrets are the keys to your kingdom. Leaking them — via GitHub, a screenshot, a Slack message, a shared document — is the #1 cause of serious cloud infrastructure breaches. This is not theoretical: GitHub scans public repositories continuously and notifies service providers when API keys are found. Attackers also scan GitHub in real time. Never put secrets in code. This is absolute. Use environment variables at runtime, injected by your CI/CD system or deployment platform. For local development, use a .env file that is git-ignored (verify .gitignore covers it). For production, use: Vercel's environment variables (encrypted at rest), Cloudflare's Workers Secrets (never exposed in logs or APIs), or a dedicated secrets manager like HashiCorp Vault or AWS Secrets Manager. Audit your current repositories right now. Search for: 'API_KEY', 'SECRET', 'PASSWORD', 'sk_live', 'STRIPE', 'anthropic' in your codebase (use grep or IDE search). Any hardcoded values are high-priority issues. If you find historical secrets in git history, rotate them immediately — the history persists even after you remove the secret from the current file.

A shared Google Doc of passwords, a Notion page with credentials, or a WhatsApp message with an API key — these are the security practices that cause breaches. A team password manager is the single most impactful security improvement for a small business. 1Password Teams ($19.95 AUD/user/month) is the market leader: works on all devices including iOS, supports iOS PassKeys, has an excellent browser extension, allows secure sharing of credentials between team members without revealing the password, and maintains an audit log of credential access. For Darkice Interactive with 2–5 team members, this costs $40–$100/month — less than one hour of your billing rate. 1Password's 'Vaults' feature is key: create separate vaults for different products/clients (BathCheck vault, Gliderol vault, Dormakaba vault). Only give team members access to the vaults they need. This limits the blast radius if one team member's account is compromised. For all service accounts used by Darkice Interactive — GitHub, AWS, Cloudflare, Anthropic, Stripe, Apple Developer — create dedicated credentials that are stored in 1Password and never shared informally. Rotate them annually or when a team member leaves.