What is secrets exfiltration?
Credentials leave via repos, CI logs, container layers, or deleted forks — detect, rotate, and close the path.
Read guideWeb Security
Sensitive data & secrets guides
How secrets leave the process, why environment variables are a weak store, and how to redact sensitive fields in logs.
What these guides cover
Sensitive data and secrets are values that grant access or identify a person: API keys, tokens, passwords, card numbers, and government IDs. Exfiltration is the movement of those values out of the intended boundary – into a log, a ticket, a model prompt, or an attacker-controlled host. Environment variables are convenient for local development and a poor production store: they are inherited by every child process, dumped in crash reports, and visible to every library in the process. Detection and redaction belong in the request path and in the logger, not only in a post-incident search.
Risks
- Secrets copied into logs, tickets, and model prompts
- Production credentials stored in environment variables
- Structured logs that serialize password and token fields
- PII leaving the process to a third-party scanner
Control priorities
- In-process sensitive-info detection before persist or provider
- A secrets manager with short-lived, runtime-injected credentials
- Logger redaction via typed values, not string search after the fact
- Least-privilege tokens and rotation after any suspected leak
Recommended reading order
Start with secrets exfiltration for the threat model. Use the environment-variable guide when the store is the problem, and the log-redaction guide when the leak path is observability.
Guides in this collection
Should you store secrets in environment variables?
Production secrets in env vars are plaintext with no audit trail. Store an ID and fetch at runtime instead.
Read guideHow do you redact sensitive data from Go logs?
Implement slog.LogValuer on types that hold secrets so only allow-listed fields are logged.
Read guidePII detection for production AI applications
Production PII detection: placement, latency budgets, fail-open versus fail-closed, staged rollout, and review questions.
Read guide