Zero-Trust Secret Vault & Credential Security Expert (2026 Edition)

English | Bahasa Indonesia

---

<a name="english"></a>

English

Description

Production security engineering guide for Zero-Trust Secret Management across microservices, edge deployments, and CI/CD pipelines. Eliminates plain-text .env files in git repositories and container images using Infisical, HashiCorp Vault, and Doppler. Covers automated API key rotation, dynamic short-lived database credentials, Gitleaks pre-commit scanning, and memory-safe secret injection in Node.js, Bun, and Next.js 15.

Trigger Conditions

• Storing high-privilege credentials (database passwords, Stripe/DOKU API keys, AWS secret keys).
• Replacing static, committed .env files with encrypted, centrally-managed secret stores.
• Setting up automated credential rotation (e.g., 30-day rotation for payment gateway webhooks).
• Preventing accidental secret leaks during git commits and pull request reviews.

Level 1: Dynamic Ephemeral Credentials (Infisical SDK 2026)

// src/lib/vault/secret-loader.ts
import { InfisicalClient } from '@infisical/sdk';

let vaultClient: InfisicalClient | null = null;

export async function getSecureSecret(secretName: string): Promise<string> {
  // Fallback to local process.env during offline development only
  if (process.env.NODE_ENV === 'development' && process.env[secretName]) {
    return process.env[secretName]!;
  }

  if (!vaultClient) {
    vaultClient = new InfisicalClient({
      clientId: process.env.INFISICAL_CLIENT_ID!,
      clientSecret: process.env.INFISICAL_CLIENT_SECRET!,
    });
  }

  const secret = await vaultClient.getSecret({
    environment: process.env.VAULT_ENV || 'prod',
    projectId: process.env.INFISICAL_PROJECT_ID!,
    secretKey: secretName,
  });

  if (!secret?.secretValue) {
    throw new Error(`[Zero-Trust-Vault] Failed to retrieve mandatory secret: ${secretName}`);
  }

  return secret.secretValue;
}

Level 2: Gitleaks Pre-Commit Secret Scanner

# .gitleaks.toml
title = "Vibes-Plug Zero-Trust Leak Prevention"

[extend]
useDefault = true

[[rules]]
id = "generic-api-key"
description = "Detects plain-text high-entropy API keys"
regex = '''(?i)(?:key|api|token|secret|password)[ \t]*[=:][ \t]*['"]([a-z0-9_\-\.]{20,})['"]'''
entropy = 3.5
secretGroup = 1
keywords = ["key", "api", "token", "secret", "password"]

The 4 Non-Negotiable Zero-Trust Rules

1. Never Commit .env Files: .env* files (except .env.example) MUST be included in .gitignore and .npmignore. Commit history must be scoured with gitleaks.
2. Ephemeral Credentials: For databases, prefer short-lived dynamic credentials with 1-hour TTL generated by Vault rather than permanent static passwords.
3. No Secret Echo in Logs: Never log process.env or print connection strings containing passwords to terminal stdout or APM error reports.
4. Principle of Least Privilege: Subagents and microservices must have read access strictly to their own scoped directory path (/services/billing/*), never to the root vault.

Orchestration & Integration

• ci-cd-devops-architect: Connects pipeline jobs via GitHub OIDC to fetch secrets without static tokens.
• authentication-identity-expert: Rotates JWT signing secrets and OAuth client credentials.
• production-ready-hardener: Audits the repository for accidental secret leaks before deployment.

---

<a name="bahasa-indonesia"></a>

Bahasa Indonesia

Integrasi Orkestrasi

Terhubung dan mengorkestrasi bersama ci-cd-devops-architect, authentication-identity-expert, dan production-ready-hardener.

Deskripsi

Panduan rekayasa keamanan produksi untuk Manajemen Rahasia Zero-Trust (Zero-Trust Secret Management) di seluruh microservices, edge computing, dan pipeline CI/CD. Menghilangkan file teks biasa .env dari repositori git dan image kontainer Docker menggunakan Infisical, HashiCorp Vault, dan Doppler. Mencakup rotasi kunci API otomatis, kredensial database sementara (ephemeral), pemindaian kebocoran Gitleaks pada pre-commit, dan injeksi memori aman pada Node.js, Bun, dan Next.js 15.

Kondisi Pemicu

• Menyimpan kredensial berhak istimewa tinggi (password database, API key Stripe/DOKU, secret key cloud).
• Menggantikan file .env statis yang rentan bocor dengan vault terenkripsi terpusat.
• Menerapkan rotasi kredensial otomatis (misal: rotasi kunci webhook setiap 30 hari).
• Mencegah insiden kebocoran kunci rahasia saat melakukan git commit atau pull request.

Contoh Injeksi Runtime via CLI (Tanpa File .env di Server)

# Menjalankan aplikasi secara aman dengan injeksi variabel memori langsung dari Vault
infisical run --env=prod -- node dist/index.js

4 Aturan Mutlak Zero-Trust

1. Dilarang Komit File .env: File .env wajib masuk dalam .gitignore. Gunakan alat pemindai seperti Gitleaks untuk memeriksa riwayat komit sebelum kode dipublikasikan.
2. Kredensial Dinamis Berumur Pendek: Prioritaskan pembuatan user dan password database sementara dengan masa berlaku (TTL) 1 jam dari HashiCorp Vault alih-alih password permanen.
3. Sensor Kunci Rahasia: Jangan pernah mencetak console.log(process.env) atau menampilkan connection string database di log terminal maupun Sentry.
4. Hak Akses Terkecil (Least Privilege): Batasi izin akses secret per modul. Layanan frontend hanya boleh mengakses kunci publik, sedangkan rahasia backend diisolasi di folder terpisah.

Integrasi Orkestrasi

• ci-cd-devops-architect: Mengintegrasikan otentikasi OIDC ke GitHub Actions tanpa token statis.
• authentication-identity-expert: Merotasi kunci privat JWT dan rahasia penyedia OAuth.
• production-ready-hardener: Memindai repositori untuk memastikan tidak ada kunci rahasia yang tertinggal sebelum rilis.