326. Where Do Secrets Belong In My Application?

Most applications have to deal with Most applications have to deal with secret information. From API keys to secret information. From API keys to secret information. From API keys to passwords to connection strings, passwords to connection strings, passwords to connection strings, connecting to sensitive resources connecting to sensitive resources connecting to sensitive resources involves secrets. So, where do you put involves secrets. So, where do you put involves secrets. So, where do you put them? How do you ensure they are staying them? How do you ensure they are staying them? How do you ensure they are staying secret? Those answers change based upon secret? Those answers change based upon secret? Those answers change based upon a lot of factors, including development a lot of factors, including development a lot of factors, including development versus production and whether or not versus production and whether or not versus production and whether or not you're using AI to help you in you're using AI to help you in you're using AI to help you in development. So, let's talk about it in development. So, let's talk about it in development. So, let's talk about it in today's episode of Dev Questions. >> Software development is more than just >> Software development is more than just writing code. So, let's talk about the writing code. So, let's talk about the writing code. So, let's talk about the rest of it. Specifically, let's talk rest of it. Specifically, let's talk rest of it. Specifically, let's talk about where to store your secrets as a about where to store your secrets as a about where to store your secrets as a developer. developer. developer. And let's start off by saying that this And let's start off by saying that this And let's start off by saying that this answer has changed a bit in light of AI answer has changed a bit in light of AI answer has changed a bit in light of AI agents. So, what was recommended agents. So, what was recommended agents. So, what was recommended practice isn't necessarily the right practice isn't necessarily the right practice isn't necessarily the right call anymore. Also, I'm going to be call anymore. Also, I'm going to be call anymore. Also, I'm going to be addressing this as a .NET developer. If addressing this as a .NET developer. If addressing this as a .NET developer. If you are a .NET developer, some of this you are a .NET developer, some of this you are a .NET developer, some of this might not apply. However, most of it might not apply. However, most of it might not apply. However, most of it will and the principles will be similar will and the principles will be similar will and the principles will be similar for your language. I will be talking for your language. I will be talking for your language. I will be talking about front-end frameworks like React as about front-end frameworks like React as about front-end frameworks like React as well, so that will directly apply.

well, so that will directly apply. well, so that will directly apply. Let's start with a big one. Developers Let's start with a big one. Developers Let's start with a big one. Developers should not have access to any production should not have access to any production should not have access to any production resources. Now, there is an exception resources. Now, there is an exception resources. Now, there is an exception here for if you're on a very small team here for if you're on a very small team here for if you're on a very small team where you're also the the the production where you're also the the the production where you're also the the the production deployment person, deployment person, deployment person, but even then, there needs to be some but even then, there needs to be some but even then, there needs to be some separation. separation. separation. So, So, So, the information you have, whether you the information you have, whether you the information you have, whether you are a small team that's your job to or are a small team that's your job to or are a small team that's your job to or whether it's somebody else's job, the whether it's somebody else's job, the whether it's somebody else's job, the information about the secrets, about the information about the secrets, about the information about the secrets, about the connection strings and other things, connection strings and other things, connection strings and other things, should be stored in something like Azure should be stored in something like Azure should be stored in something like Azure Key Vault and the devs should not have Key Vault and the devs should not have Key Vault and the devs should not have access to it or to the production access to it or to the production access to it or to the production servers. servers. servers. This is especially true This is especially true This is especially true if AI has access to developer machines. if AI has access to developer machines. if AI has access to developer machines. >> [snorts] >> [snorts] >> [snorts] >> AI looks for credentials. It's >> AI looks for credentials. It's >> AI looks for credentials. It's unfortunately one of the things that unfortunately one of the things that unfortunately one of the things that that people don't realize AI does. It that people don't realize AI does. It that people don't realize AI does. It when you give an AI permission to look when you give an AI permission to look when you give an AI permission to look at your hard drive, it doesn't always at your hard drive, it doesn't always at your hard drive, it doesn't always stay where it's supposed to stay.

stay where it's supposed to stay. stay where it's supposed to stay. Sometimes it wanders a bit. And one of Sometimes it wanders a bit. And one of Sometimes it wanders a bit. And one of the things that we have seen over and the things that we have seen over and the things that we have seen over and over is that an AI will look to elevate over is that an AI will look to elevate over is that an AI will look to elevate its own permissions to solve the problem its own permissions to solve the problem its own permissions to solve the problem of not having access to something. of not having access to something. of not having access to something. And it has more than one once looked and And it has more than one once looked and And it has more than one once looked and found those credentials and then treated found those credentials and then treated found those credentials and then treated that like it's a development resource that like it's a development resource that like it's a development resource and done some pretty horrific things in and done some pretty horrific things in and done some pretty horrific things in production. production. production. So, we need very careful to separate out So, we need very careful to separate out So, we need very careful to separate out our sensitive data from our AIs. But our sensitive data from our AIs. But our sensitive data from our AIs. But even from developers, even from developers, even from developers, they should not have access to they should not have access to they should not have access to production. And I know a lot of production. And I know a lot of production. And I know a lot of developers say, "No, I definitely developers say, "No, I definitely developers say, "No, I definitely should. How else can I debug it? How should. How else can I debug it? How should. How else can I debug it? How else could I There are ways as long as else could I There are ways as long as else could I There are ways as long as you're focused on being secure. you're focused on being secure. you're focused on being secure. If you're focused on being fast and I'm If you're focused on being fast and I'm If you're focused on being fast and I'm just {quote} getting the job done and just {quote} getting the job done and just {quote} getting the job done and not worried about security, sure. Have not worried about security, sure. Have not worried about security, sure. Have access to the the keys for everything access to the the keys for everything access to the the keys for everything and then just be safe. Right? But that's and then just be safe. Right? But that's and then just be safe. Right? But that's not a good practice. A good practice is not a good practice. A good practice is not a good practice. A good practice is to have clear separation and automated to have clear separation and automated to have clear separation and automated systems that take you the last steps.

systems that take you the last steps. systems that take you the last steps. Because part of your process should be a Because part of your process should be a Because part of your process should be a good CI/CD process that takes your code good CI/CD process that takes your code good CI/CD process that takes your code from one location to another in from one location to another in from one location to another in automated manner so you're testing how automated manner so you're testing how automated manner so you're testing how it's going to work when you deploy. it's going to work when you deploy. it's going to work when you deploy. That way you are sure this is going work That way you are sure this is going work That way you are sure this is going work and you're not going to have surprises and you're not going to have surprises and you're not going to have surprises when you hit production. This makes your when you hit production. This makes your when you hit production. This makes your deployment to production faster, it deployment to production faster, it deployment to production faster, it makes it cleaner, it makes it less makes it cleaner, it makes it less makes it cleaner, it makes it less likely to have to be rolled back and likely to have to be rolled back and likely to have to be rolled back and more. So, that whole process should be more. So, that whole process should be more. So, that whole process should be automated anyway. automated anyway. automated anyway. So, developers shouldn't be touching So, developers shouldn't be touching So, developers shouldn't be touching production directly for deployments. production directly for deployments. production directly for deployments. So, the other part of that is, well, So, the other part of that is, well, So, the other part of that is, well, developers need to have access in order developers need to have access in order developers need to have access in order to debug stuff. Well, if you are to debug stuff. Well, if you are to debug stuff. Well, if you are properly backing up your production properly backing up your production properly backing up your production systems, especially your databases, and systems, especially your databases, and systems, especially your databases, and then clean that data and putting it into then clean that data and putting it into then clean that data and putting it into development as a development database, development as a development database, development as a development database, you often don't need to even do that you often don't need to even do that you often don't need to even do that because the development data is just because the development data is just because the development data is just hours different than production. So, all hours different than production. So, all hours different than production. So, all of a sudden, now you have all the data of a sudden, now you have all the data of a sudden, now you have all the data you need while being secure, things like you need while being secure, things like you need while being secure, things like email addresses have been sanitized, email addresses have been sanitized, email addresses have been sanitized, things like personally identifiable things like personally identifiable things like personally identifiable information has been changed so that information has been changed so that information has been changed so that you're not giving developers access to you're not giving developers access to you're not giving developers access to sensitive information, but at the same sensitive information, but at the same sensitive information, but at the same time they have all the information they time they have all the information they time they have all the information they need for testing.

need for testing. need for testing. And your environment should be very, And your environment should be very, And your environment should be very, very similar between production and very similar between production and very similar between production and development so that you can accurately development so that you can accurately development so that you can accurately test on things. So, yes, I recommend test on things. So, yes, I recommend test on things. So, yes, I recommend that developers not have access to any that developers not have access to any that developers not have access to any production resources, production resources, production resources, especially, not just because, but especially, not just because, but especially, not just because, but especially especially especially if they use AI. if they use AI. if they use AI. Because too often, AI will use those Because too often, AI will use those Because too often, AI will use those credentials or ingest those credentials, credentials or ingest those credentials, credentials or ingest those credentials, which means they all need to be rotated. which means they all need to be rotated. which means they all need to be rotated. Okay. So, what do you do during Okay. So, what do you do during Okay. So, what do you do during development? development? development? Well, if you're a .NET developer, Well, if you're a .NET developer, Well, if you're a .NET developer, store your secrets in the user store your secrets in the user store your secrets in the user secrets.json file. If you don't know secrets.json file. If you don't know secrets.json file. If you don't know what that is, I've got videos on it on what that is, I've got videos on it on what that is, I've got videos on it on my channel. I have a whole um course my channel. I have a whole um course my channel. I have a whole um course dedicated to app settings, including dedicated to app settings, including dedicated to app settings, including user secrets. Um user secrets. Um user secrets. Um these are for things where it's going to these are for things where it's going to these are for things where it's going to be local. be local. be local. So, you're working on a local database. So, you're working on a local database. So, you're working on a local database. You're working on a a local email server You're working on a a local email server You're working on a a local email server equivalent where it's just, you know, equivalent where it's just, you know, equivalent where it's just, you know, showing that yes, an email went out or showing that yes, an email went out or showing that yes, an email went out or something like that, but it's not something like that, but it's not something like that, but it's not actually sending emails. Um, all these actually sending emails. Um, all these actually sending emails. Um, all these different things, they're local and you different things, they're local and you different things, they're local and you have your own local settings. If you put have your own local settings. If you put have your own local settings. If you put those in user secrets, they don't go those in user secrets, they don't go those in user secrets, they don't go into your source control, they don't into your source control, they don't into your source control, they don't disrupt the other users on the team and disrupt the other users on the team and disrupt the other users on the team and what their local secrets are, and yet what their local secrets are, and yet what their local secrets are, and yet you can use your own local secrets to you can use your own local secrets to you can use your own local secrets to have your own local setup. This is the have your own local setup. This is the have your own local setup. This is the way to do it.

way to do it. way to do it. So, that's kind of step one. Have a So, that's kind of step one. Have a So, that's kind of step one. Have a place for local secrets. Again, .NET place for local secrets. Again, .NET place for local secrets. Again, .NET developers, we have it easy. We just use developers, we have it easy. We just use developers, we have it easy. We just use user secrets. user secrets. user secrets. Now, Now, Now, with that, do not give AI access to your with that, do not give AI access to your with that, do not give AI access to your hard drive. hard drive. hard drive. Which you probably say, "Ah, that's too Which you probably say, "Ah, that's too Which you probably say, "Ah, that's too late for that. I've already done that." late for that. I've already done that." late for that. I've already done that." Change that. Don't do that. Change that. Don't do that. Change that. Don't do that. Instead, run it in a container. Instead, run it in a container. Instead, run it in a container. Give it full access if you want to that Give it full access if you want to that Give it full access if you want to that container, container, container, but not to your actual hard drive. but not to your actual hard drive. but not to your actual hard drive. Otherwise, Otherwise, Otherwise, there are too many things that AI can do there are too many things that AI can do there are too many things that AI can do to compromise you. It can read through to compromise you. It can read through to compromise you. It can read through your entire your entire your entire entire drive and figure out what secrets entire drive and figure out what secrets entire drive and figure out what secrets might be there. might be there. might be there. It can look at your browser headless and It can look at your browser headless and It can look at your browser headless and look at all the local stores and session look at all the local stores and session look at all the local stores and session storage in your browser storage in your browser storage in your browser for any secrets that may be there. for any secrets that may be there. for any secrets that may be there. So, it can do a lot of things that you So, it can do a lot of things that you So, it can do a lot of things that you really don't want to have ac- really don't want to have ac- really don't want to have ac- have it have access to. have it have access to. have it have access to. And all of a sudden, your AI might have And all of a sudden, your AI might have And all of a sudden, your AI might have access to things that you never expected access to things that you never expected access to things that you never expected it to.

it to. it to. So, make sure you isolate your AI from So, make sure you isolate your AI from So, make sure you isolate your AI from your actual development machine. Run it your actual development machine. Run it your actual development machine. Run it in a container. It's absolutely in a container. It's absolutely in a container. It's absolutely possible. It's not that hard. You can do possible. It's not that hard. You can do possible. It's not that hard. You can do this. this. this. Make sure you separate it from your Make sure you separate it from your Make sure you separate it from your development machine. Again, because when development machine. Again, because when development machine. Again, because when you store your user secrets in that you store your user secrets in that you store your user secrets in that secrets.json, secrets.json, secrets.json, well, your AI can go and read those. well, your AI can go and read those. well, your AI can go and read those. And those should not be secret. And those should not be secret. And those should not be secret. Okay? Those should not be a big deal. Okay? Those should not be a big deal. Okay? Those should not be a big deal. They should be something that can be They should be something that can be They should be something that can be given away. They because you should be given away. They because you should be given away. They because you should be using like, you know, essay for both the using like, you know, essay for both the using like, you know, essay for both the username and password for a SQL username and password for a SQL username and password for a SQL database. And you might, you know, using database. And you might, you know, using database. And you might, you know, using a connection string that has no a connection string that has no a connection string that has no credentials, but lets you log into a credentials, but lets you log into a credentials, but lets you log into a local database. These things should not local database. These things should not local database. These things should not be secrets. But you still don't want to be secrets. But you still don't want to be secrets. But you still don't want to have access give AI access to things it have access give AI access to things it have access give AI access to things it shouldn't have access to. Especially if shouldn't have access to. Especially if shouldn't have access to. Especially if you're a person who reuses credentials you're a person who reuses credentials you're a person who reuses credentials too much. Don't do that. too much. Don't do that. too much. Don't do that. And that kind of leads us into the next And that kind of leads us into the next And that kind of leads us into the next point. Do not access production point. Do not access production point. Do not access production resources locally.

resources locally. resources locally. This is one that's, you know, This is one that's, you know, This is one that's, you know, we all violate at some point because we all violate at some point because we all violate at some point because it's just easier. And it's just easier. And it's just easier. And don't do this. Don't give into this. But don't do this. Don't give into this. But don't do this. Don't give into this. But this is one where, you know what? I'm this is one where, you know what? I'm this is one where, you know what? I'm going to I'm going to put the production going to I'm going to put the production going to I'm going to put the production connection string in my in my app and connection string in my in my app and connection string in my in my app and run it locally just to see what's run it locally just to see what's run it locally just to see what's happening. But I can debug easier if I happening. But I can debug easier if I happening. But I can debug easier if I have Visual Studio open in debug mode, have Visual Studio open in debug mode, have Visual Studio open in debug mode, but have the production connection but have the production connection but have the production connection string. string. string. Don't do that. Don't do that. Don't do that. Because then what happens is you've Because then what happens is you've Because then what happens is you've given access to potentially an AI to given access to potentially an AI to given access to potentially an AI to scan that. If you have If you're using scan that. If you have If you're using scan that. If you have If you're using Visual Studio, you might have Copilot Visual Studio, you might have Copilot Visual Studio, you might have Copilot running and that could potentially see running and that could potentially see running and that could potentially see your connection strings. your connection strings. your connection strings. Don't do that. You might accidentally Don't do that. You might accidentally Don't do that. You might accidentally put it into source control and that's a put it into source control and that's a put it into source control and that's a big issue. Um so, don't do that. Don't big issue. Um so, don't do that. Don't big issue. Um so, don't do that. Don't use use use production resources locally. It's just production resources locally. It's just production resources locally. It's just too easy to let those slip out in some too easy to let those slip out in some too easy to let those slip out in some way. way. way. Next up, do not give AI full access to Next up, do not give AI full access to Next up, do not give AI full access to GitHub. GitHub. GitHub. Again, I've told you put AI in a Again, I've told you put AI in a Again, I've told you put AI in a container and run a container.

container and run a container. container and run a container. Well, give it a a personal access token. Well, give it a a personal access token. Well, give it a a personal access token. Okay? Don't give it a full token. Give Okay? Don't give it a full token. Give Okay? Don't give it a full token. Give it access to just what it needs in it access to just what it needs in it access to just what it needs in GitHub. Because again, if you give it GitHub. Because again, if you give it GitHub. Because again, if you give it full access, it gets your access to full access, it gets your access to full access, it gets your access to GitHub. If it's using your access on GitHub. If it's using your access on GitHub. If it's using your access on your machine, well, you have access to your machine, well, you have access to your machine, well, you have access to go look at user secrets potentially. go look at user secrets potentially. go look at user secrets potentially. Or change user secrets. Or change user secrets. Or change user secrets. That's a problem. Like, there are GitHub That's a problem. Like, there are GitHub That's a problem. Like, there are GitHub secrets that it could access or use in a secrets that it could access or use in a secrets that it could access or use in a way that you don't want it to use. way that you don't want it to use. way that you don't want it to use. Don't do that. Don't do that. Don't do that. Don't give it full access to GitHub. Use Don't give it full access to GitHub. Use Don't give it full access to GitHub. Use a personal access token and limit that, a personal access token and limit that, a personal access token and limit that, restrict that. restrict that. restrict that. Next up, use containers for all local Next up, use containers for all local Next up, use containers for all local development resources as much as development resources as much as development resources as much as possible. So, for instance, I used to possible. So, for instance, I used to possible. So, for instance, I used to install SQL Server on my development install SQL Server on my development install SQL Server on my development machine. I use it so often, I'm like, machine. I use it so often, I'm like, machine. I use it so often, I'm like, well, this is what you do. You install well, this is what you do. You install well, this is what you do. You install it locally cuz I don't want to work it locally cuz I don't want to work it locally cuz I don't want to work across a network somehow. And yes, you across a network somehow. And yes, you across a network somehow. And yes, you could use, you know, local DB or could use, you know, local DB or could use, you know, local DB or something like that, but it was just something like that, but it was just something like that, but it was just easier to install SQL Server. I haven't easier to install SQL Server. I haven't easier to install SQL Server. I haven't done that in years.

done that in years. done that in years. Because I use containers. Because I use containers. Because I use containers. I can spin up a SQL Server in minutes I can spin up a SQL Server in minutes I can spin up a SQL Server in minutes and have it running. I have a SQL and have it running. I have a SQL and have it running. I have a SQL Server, I have a DB server, I have Server, I have a DB server, I have Server, I have a DB server, I have a Raven DB server, I have uh a Raven DB server, I have uh a Raven DB server, I have uh Azure right, I have a whole bunch of Azure right, I have a whole bunch of Azure right, I have a whole bunch of different servers running when I need different servers running when I need different servers running when I need them to. When I don't need them to, I them to. When I don't need them to, I them to. When I don't need them to, I shut them down. shut them down. shut them down. This isolates them. It also makes them This isolates them. It also makes them This isolates them. It also makes them very easy to dispose and restart. very easy to dispose and restart. very easy to dispose and restart. This is something you want to do. Get This is something you want to do. Get This is something you want to do. Get used to using containers. used to using containers. used to using containers. Use them over and over again, but then Use them over and over again, but then Use them over and over again, but then throw them away when you don't need them throw them away when you don't need them throw them away when you don't need them anymore and start over. anymore and start over. anymore and start over. Containers are amazing. They make your Containers are amazing. They make your Containers are amazing. They make your system run faster. You do not running system run faster. You do not running system run faster. You do not running SQL Server in the background taking up SQL Server in the background taking up SQL Server in the background taking up lots of memory for no reason. So, lots of memory for no reason. So, lots of memory for no reason. So, it makes your system faster, but it also it makes your system faster, but it also it makes your system faster, but it also makes it easier to reset things and makes it easier to reset things and makes it easier to reset things and start over. start over. start over. So, as a developer, you shouldn't be So, as a developer, you shouldn't be So, as a developer, you shouldn't be directly accessing production systems or directly accessing production systems or directly accessing production systems or resources. Keep that separation clear. resources. Keep that separation clear. resources. Keep that separation clear. Otherwise, a mistake locally can damage Otherwise, a mistake locally can damage Otherwise, a mistake locally can damage or destroy your production systems.

or destroy your production systems. or destroy your production systems. Instead, use local resources with Instead, use local resources with Instead, use local resources with throwaway credentials for local throwaway credentials for local throwaway credentials for local development. Even then, keep your AI development. Even then, keep your AI development. Even then, keep your AI tools and agents away from your tools and agents away from your tools and agents away from your development machine itself. development machine itself. development machine itself. Keep them segmented into containers or Keep them segmented into containers or Keep them segmented into containers or virtual machines so they cannot find virtual machines so they cannot find virtual machines so they cannot find elevated permissions in a credential elevated permissions in a credential elevated permissions in a credential hunt. It's They're going to try at some hunt. It's They're going to try at some hunt. It's They're going to try at some point. point. point. Just protect yourself. All right? Thanks Just protect yourself. All right? Thanks Just protect yourself. All right? Thanks for listening and as always, I am Tim for listening and as always, I am Tim for listening and as always, I am Tim Corey.