FDE ForgeBeta
Start free
Week 4 · Foundation

A secrets manager, not env files

0:00 / 3:00

15 seconds

.env made it to GitHub.

The DB password was in a file the Dockerfile COPY'd. History still has it.

.envCommittedSecrets mgrRuntimeAPIReads at boot
Lesson notesA secrets manager, not env files: the short version+

Week 4 · Cloud & containers · about 3 minutes

What you will be able to do

Load the ticket DB password from a secrets manager at runtime instead of committing .env to the image or repo.

The idea

Application secrets are injected when the task starts — from AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, or the customer's equivalent.

Local .env is fine on a laptop. It is not a deploy mechanism. The production container receives DATABASE_URL from the platform, not from a file in the build context.

import os

# Platform injects this from the secrets manager at runtime.
DATABASE_URL = os.environ["DATABASE_URL"]

# Never: open(".env").read() inside the container image.

If the secret is in Git history, rotate it — deleting the file is not enough.

Key takeaways

  • Secrets manager (or platform secret store) owns the password.
  • Containers read env injected at start.
  • Rotate anything that was ever committed.

Part of the Forward Deployed Engineer roadmap. New to the role? Start with what a Forward Deployed Engineer does.