Can you keep a secret? - An Overview of the OWASP Secrets Management Cheat Sheet

The talk introduces the newly published OWASP Secrets Management Cheat Sheet, written by a group of OWASP contributors who often disagreed on how secrets should be handled. The speaker frames the problem with secret sprawl, citing rising counts of credentials found in source code and a supply chain incident in which server-side credentials were reached through a file upload flaw. Less obvious leak paths also get attention, such as pull requests whose compressed or minified diffs can hide injected code, and secrets pasted into tickets or chat tools.

The middle of the talk covers the guidance. Secrets should stay out of code and environment variables, which often end up in logs, and should instead be injected at bootstrap time or loaded into a temporary in-memory file. Storage should sit close to where workloads run rather than being forced into one central platform, with the trade-off of a single point of failure acknowledged. Access should follow least privilege, with generation, rotation and expiration automated. Detection of exposed secrets, including in logs, and regular testing of those detections with a secret scanning tool are also covered.

The closing advice is to prepare an incident response runbook that lets teams rotate credentials quickly and scrub exposed values. An anecdote about a stolen laptop holding over a thousand certificates shows how costly manual rotation can be. The speaker points to the OWASP Wrong Secrets project as a hands-on way to practise detection and encourages attendees to read the cheat sheet and contribute to it.