On secret management
I been working these days on my free time to come up with a decent setup to manage secrets across environments, CI/CD, AI agents, and devs' multiple machines. I believe I finally got a good one.
- NO secrets in .env, nor in any other plain-text and/or unprotected store
- loading secrets must be easy, one-cmd away
- production secrets must be super-protected (aka: accessible to trusted ICs only)
- staging and CI/CD considered super-sensitive as well (I don't like being hacked)