https://latini.dev/tags/secrets-management/Recent content in Secrets-Management on F. Latini - IT EngineerHugoenThu, 30 Jul 2026 08:00:00 +0000https://latini.dev/posts/your-security-policy-needs-a-paved-road/Thu, 30 Jul 2026 08:00:00 +0000https://latini.dev/posts/your-security-policy-needs-a-paved-road/<p><strong>TL;DR</strong> - Almost every security control I meet in the wild was shipped as a rule and never as a road. The policy exists, the scanner runs, the build fails, and there is still a long-lived API key in a <code>.env</code> file, because nobody ever built the thing a developer is supposed to do <em>instead</em>. A rule without a road is a tax you levy on developers, and taxes get evaded, creatively and quietly. Treat secrets and policy the way you&rsquo;d treat any other platform capability: distribute identity instead of secret values so the credential is short-lived and nobody handles it; ship every new control with a default that already satisfies it, an error message that names the fix, and a migration for what already exists; roll it out observe, then warn, then enforce; and make exceptions a first-class artefact that expires. The security team writes the rule. The platform team owes the road. Ship them in the same change or don&rsquo;t ship the rule.</p>