The Free Encyclopedia
Log in
Article History

Secrets Management

From theLAB Wiki — last edited Jun 26, 2026

Credentials — DB passwords, API keys, tokens — are the crown jewels. The goal: keep them out of source control, out of the web root, and readable only by the process that needs them.

Keep config outside the web root

The wiki's DB password lives above public/, so the web server can never serve it even if PHP stops executing:

/var/www/wiki.thelabsource.com/
├── config.php      ← secrets here (NOT web-served)
└── public/         ← document root
    └── index.php   require '../config.php';
sudo chmod 640 config.php
sudo chown youruser:www-data config.php     # owner + group only

Rules

Do Don't
Store secrets outside web root / in env Commit secrets to git
.gitignore config & .env Hardcode keys in app code
One credential per service, least privilege Reuse one password everywhere
Rotate on exposure Email/paste secrets in chat

Scrub secrets from git history

# if a secret was committed
git rm --cached config.php && echo "config.php" >> .gitignore
# already pushed? rotate the secret AND purge history (git filter-repo)

Pairs with MariaDB Socket Auth vs TCP Users (one least-privilege DB user per app) and Securing a Public PHP App.

Categories: Secrets Security