What is a secret in software?

A secret is any value that lets its holder act as someone or reach something, such as an API key, a database password, a cloud access key, a signing key or a session token, so that anyone who copies it gains the same power without asking.

What makes a value a secret

The test is simple: if a stranger who learned the value could read data, spend money or impersonate your service, it is a secret. LOG_LEVEL=debug is configuration. STRIPE_SECRET_KEY=sk_live_EXAMPLE_not_a_real_key is a secret, because the provider accepts it as proof of identity with no further checks.

Secrets have three properties that shape how you handle them:

• They are bearer credentials. Possession is enough. The provider cannot tell your copy from a leaked one.
• They are long-lived by default. Many provider keys work until someone revokes them.
• They spread. A value pasted into chat, a ticket or a CI log stays there after the original use is over.

The OWASP Secrets Management Cheat Sheet describes this spread as secret sprawl and recommends one central, documented place where each secret's purpose and owner are known.

Handling secrets well

• Store them in one place built for it, encrypted, with access per person and per system.
• Give each person, server and pipeline only the secrets its job needs.
• Keep them out of source code, chat and logs.
• Know where each value came from, so you can reissue it at the provider when it may have leaked.
• Assume that anything someone has seen may have been copied. Removing access stops future reads but does not erase past ones.

How Crunu treats secrets

Crunu is a team vault for environment variables and secrets. Values are encrypted on your devices, in the browser or in the crunu agent, and the server stores only ciphertext. Secrets are grouped into projects and environments, and each environment has its own key, so access to payments-api / development does not open payments-api / production.

Crunu also keeps a distinction that matters in practice. Rotating keys in Crunu changes the encryption keys of an environment, which protects future versions. The secret values themselves, like a Stripe key, can only be changed at the provider. When someone leaves, the reissue checklist lists the values to reissue at providers without showing the values. See offboarding and the security limitations.

In the product interface, "secret" means a value like an API key, and "key" means an encryption or signing key. Variable names are called names, not keys.

Sources

• OWASP Secrets Management Cheat Sheet, checked October 27, 2026.