nessi/NexaPG
1
0
Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases 14 Activity

[NX-204] Create production secret management guide #14

New Issue
Closed
opened 2026-02-13 13:18:55 +00:00 by nessi · 1 comment
nessi commented 2026-02-13 13:18:55 +00:00
Owner
Copy Link
Copy Source

Goal

Avoid insecure secret handling in production deployments.

Scope

  • Document secure handling for JWT secret, encryption key, DB creds, SMTP creds.
  • Recommend env/secrets providers and rotation basics.

Acceptance Criteria

  • Clear “do/don’t” section exists.
  • No recommendation to hardcode secrets.
## Goal Avoid insecure secret handling in production deployments. ## Scope - Document secure handling for JWT secret, encryption key, DB creds, SMTP creds. - Recommend env/secrets providers and rotation basics. ## Acceptance Criteria - Clear “do/don’t” section exists. - No recommendation to hardcode secrets.
nessi added this to the v1.0 - Stability, Reliability & Security (P0) milestone 2026-02-13 13:18:55 +00:00
nessi added the P0 label 2026-02-13 13:18:55 +00:00
nessi commented 2026-02-15 11:32:02 +00:00
Author
Owner
Copy Link
Copy Source

NX-204 Completed

Implemented production-focused secret handling guidance and removed ambiguous practices.

What was delivered

  • Added dedicated documentation:
    • docs/security/secret-management.md
  • Updated README:
    • Added Secret Management (Production) section
    • Added direct reference in Security Notes
    • Added TOC entry for quick access
  • Hardened .env templates:
    • .env.example
    • ops/.env.example
    • Added explicit warnings that defaults are for dev only
    • Added guidance to avoid hardcoding and to rotate secrets

Scope Coverage

  • Covered secure handling guidance for:
    • JWT_SECRET_KEY
    • ENCRYPTION_KEY
    • DB_PASSWORD
    • SMTP credentials
  • Added recommended secret provider patterns:
    • Vault / cloud secret managers / orchestrator secrets / CI runtime injection
  • Added rotation basics and operational checklist.

Acceptance Criteria Mapping

  • Clear “do/don’t” section exists
    Met: documented in docs/security/secret-management.md.

  • No recommendation to hardcode secrets
    Met: hardcoding is explicitly marked as forbidden across docs/templates.

This closes NX-204.

## NX-204 Completed Implemented production-focused secret handling guidance and removed ambiguous practices. ### What was delivered - Added dedicated documentation: - `docs/security/secret-management.md` - Updated README: - Added **Secret Management (Production)** section - Added direct reference in **Security Notes** - Added TOC entry for quick access - Hardened `.env` templates: - `.env.example` - `ops/.env.example` - Added explicit warnings that defaults are for dev only - Added guidance to avoid hardcoding and to rotate secrets ### Scope Coverage - Covered secure handling guidance for: - `JWT_SECRET_KEY` - `ENCRYPTION_KEY` - `DB_PASSWORD` - SMTP credentials - Added recommended secret provider patterns: - Vault / cloud secret managers / orchestrator secrets / CI runtime injection - Added rotation basics and operational checklist. ### Acceptance Criteria Mapping - **Clear “do/don’t” section exists** Met: documented in `docs/security/secret-management.md`. - **No recommendation to hardcode secrets** Met: hardcoding is explicitly marked as forbidden across docs/templates. This closes NX-204.
nessi closed this issue 2026-02-15 11:32:02 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0
High priority
 P1
Medium priority
 P2
Low priority
No labels P0
Milestone
No items
No Milestone v1.0 - Stability, Reliability & Security (P0)
Projects
Clear projects
No projects
Assignees
Clear assignees
nessi (Sascha Nesterovic)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: nessi/NexaPG#14