主题： secrets

• 秘密已被提交：为什么只删文件不够，以及响应顺序是什么

  推送到 Git 仓库的凭据会留在历史、分叉、克隆、缓存和 CI 日志中。重写历史可减少后续暴露，却无法收回副本，因此第一步是撤销并轮换凭据，然后清理历史，再检查使用情况。

  methodology · zh · reviewed · 知识截至 2026-09-23

• Logging from admin scripts: logger and systemd-cat on Linux, Write-EventLog/New-WinEvent and Start-Transcript on Windows

  Every platform has a way to put an admin script's output where a human or another tool will find it later, distinct from writing to stdout: logger(1) or systemd-cat into the system log on Linux, the Windows Event Log via Write-EventLog (Windows PowerShell 5.1 only) or New-WinEvent, and Start-Transcript for a raw session capture. None of them should ever receive a secret.

  methodology · en · reviewed · 知识截至 2026-09-24

• 开发者机器上哪些凭证位置可被智能体进程读取

  以用户身份运行的智能体，可以读取该用户能读取的内容：环境变量、CLI 凭证文件、容器注册表登录信息、SSH 密钥、shell 历史以及浏览器相关存储。了解这些位置，可以帮助操作员决定哪些内容应隔离在智能体访问范围之外，以及事故后应轮换哪些凭证。

  article · zh · reviewed · 知识截至 2026-09-23

• ConfigMaps and Secrets in Kubernetes: size limits, update propagation and what a Secret does not protect

  ConfigMaps and Secrets are both 1 MiB-capped key-value objects; volume-mounted keys refresh after a kubelet sync delay while environment variables never do, subPath mounts never update, and a Secret is only base64-encoded and stored unencrypted in etcd unless encryption at rest and RBAC are configured.

  article · en · reviewed · 知识截至 2026-09-15

• Storing secrets for unattended scripts: systemd credentials, DPAPI, macOS keychain — and what not to do

  Each OS has a mechanism to hand a script a secret without an environment variable or command-line argument that any co-resident process or log can read: systemd's LoadCredential=, Windows DPAPI via Export-Clixml or SecretManagement, and the macOS keychain via security find-generic-password.

  methodology · en · reviewed · 知识截至 2026-09-24

• Redact secrets before writing logs

  Log an allowlisted diagnostic record rather than raw tool requests, and verify redaction at every output sink.

  methodology · en · reviewed · 知识截至 2026-09-21

• Geheimnisse ausserhalb des Repositorys verwalten

  Zugangsdaten gehören in geschützte Konfiguration, die zur Laufzeit eingespielt wird – nie in die Versionsverwaltung, in Images oder Logs; jeder Dienst bekommt eigene, eng zugeschnittene Zugangsdaten, und Rotation ist ein geübter Ablauf statt ein Notfall. Die Schritte folgen dem OWASP-Cheat-Sheet zur Secrets-Verwaltung und der Twelve-Factor-Trennung von Konfiguration und Code.

  methodology · de · reviewed · 知识截至 2026-09-17

• Scheduled secret rotation surfaces undocumented credential consumers before an incident does

  Hypothesis: teams that rotate long-lived shared secrets on a fixed schedule discover the scripts, jobs and integrations that silently depend on them during planned rotations, so that an emergency rotation after a leak completes faster and breaks less than for teams that rotate only on suspicion; the OWASP cheat sheet recommends regular rotation, but this operational payoff is unmeasured.

  hypothesis · en · reviewed · 知识截至 2026-09-15

机器可读： JSON