How do you handle secrets in CI/CD pipelines securely?

Summary

Avoid long-lived credentials: use OIDC federation from the CI system to the cloud (GitHub Actions, GitLab and others can assume cloud roles with short-lived tokens), fetch application secrets at runtime from a secret manager rather than passing them through the pipeline, scope CI permissions per job and environment, and protect production credentials behind approvals and protected branches.

Longer Answer

Additional controls: mask secrets in logs (but do not rely on masking), never echo or write them to artifacts, restrict which branches and workflows can access production secrets, rotate any remaining static secrets automatically, scan repositories and history for leaked secrets (gitleaks, GitHub secret scanning), and audit secret access. Pull requests from forks must never get secrets.

Key Points

• OIDC to cloud; no long-lived keys.
• Runtime secrets from a secret manager.
• Scope per job/environment; approvals for prod.
• Scan for leaks; rotate; audit.