Cryptography and Secret Management
Use standard cryptographic libraries rather than implementing algorithms yourself. Passwords should be stored using dedicated password hashing rather than reversible encryption or fast hashes.
Secrets such as API keys and database passwords should come from secure secret management rather than source control.
// Conceptual:
// secret = secretManager.get("payments/api-key");
// client.authenticate(secret);
Encryption, hashing, signing, and key derivation are different operations with different purposes.
Never commit secrets
Treat leaked credentials as compromised; rotate them and use secret management.
Key Takeaways
- Do not implement cryptographic primitives yourself.
- Use dedicated password hashing for passwords.
- Keep secrets out of source code and ordinary logs.