# Secrets Management

Record: `arch:secrets-management`
Kind: activity
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: config, deployment, runtime
Canonical: https://banes-lab.com/ontology#arch-secrets-management

## Repair

- Refactored by: Move to Secret Manager, Rotate Secret
- Detected by: secret scanning
- Violated by: secrets in code/config files/logs
- Measured by: secret exposure count
- Enforced by: secret scans, CI gates

## requires

- [Secret Store](https://banes-lab.com/records/lex/secret-store.md)
- [Rotation Policy](https://banes-lab.com/records/lex/rotation-policy.md)

## reinforces

- [Secure Configuration](https://banes-lab.com/records/lex/secure-configuration.md)

## enables

- [Safe Credential Handling](https://banes-lab.com/records/lex/safe-credential-handling.md)

## conflicts-with

- [Hardcoded Secrets](https://banes-lab.com/records/lex/hardcoded-secrets.md)
- [Secret Sprawl](https://banes-lab.com/records/arch/secret-sprawl.md)

## tensions-with

- [Operational Complexity](https://banes-lab.com/records/lex/operational-complexity.md)

## tensions

- [Secrets Management Operational Complexity](https://banes-lab.com/records/tension/operational-complexity-secrets-management.md)

## contracts

- [Secret Store Over Hardcoded Secrets](https://banes-lab.com/records/algo/no-hardcoded-secrets.md)