Secrets Management for Small Teams: From .env Files to a Real Vault
Every small team starts the same way. Someone creates a .env file, it works, and it gets copied to the next developer over chat. A year later the file lives on a dozen laptops, nobody remembers which
Responses
Markdown supported · ⌘↵ to post
Damiano Bianda
Full-stack developer: Nuxt, Vue, TypeScript, Python. Based in Ticino.
The staged ladder is the right shape for this advice, especially putting SOPS + age before any managed store: it fixes the "secrets in git history" problem without adding a service to run. Two things I would add to the hygiene stage: the departing-teammate problem is usually worse than the laptop-count problem, so rotate on offboarding even before you have a vault, and add a pre-commit scan (gitleaks or similar) the same week, because the first real secret that lands in a public repo gets found by bots in minutes, not days. The CI/CD section is the one most small teams skip and should not.