Where Client Project Secrets Should Actually Live

Here is how client project secrets actually move in most small teams: a .env file sent over WhatsApp, a password in an email, a shared document with database credentials, and a production key that four people have because it was easier than setting up access.

Every one of those is permanent. Messages are backed up, emails are searchable, and nobody can tell you who still has a copy.

What a secrets manager changes

A central store where secrets live encrypted, with per-environment scoping, per-user access, an audit log, and a way for applications to fetch what they need at runtime.

Infisical is the option I reach for on client work because it self-hosts cleanly — which matters when a client's requirement is that credentials never sit on someone else's infrastructure.

infisical run --env=prod -- node server.js

Secrets are injected into the process. No .env on the server, nothing on disk for a backup to capture.

The rules I hold to

Never in the repository. .env in .gitignore from the first commit, with .env.example listing key names and no values.

Never over chat. Send an invitation to the secrets manager instead. It takes the same thirty seconds and it is revocable.

One credential per environment. Development, staging and production get separate keys. A leaked dev key that cannot touch production is an inconvenience.

One credential per consumer where possible. Separate keys for the API, the worker and CI mean you can revoke one without an outage everywhere.

Rotate on departure. When anyone leaves a project — including me — everything they could reach gets rotated. This should be a written step in your handover process, not a thing you remember.

The handover conversation

When a project ends, the client should own every credential, and I should have access to nothing. That is a five-minute task if secrets are centralised, and a genuinely uncertain exercise if they were distributed by message over eight months.

I now include the secrets store in the project setup rather than treating it as an operational afterthought. It costs nothing at the start and it is nearly impossible to retrofit cleanly.

Resources

• Repo: Infisical/infisical
• Docs: infisical.com/docs
• Video walkthroughs: YouTube: Infisical self-hosted
• When it goes wrong: Gitleaks