[esher]

We run a PHP hosting platform and that tickled us as well. We were especially upset with the common sense that storing secrets in ENV vars is a good idea — in PHP those vars are easily exposed. See our blog post: http://blog.fortrabbit.com/how-to-keep-a-secret — here we suggested:

1. create a secret key, store it with the code of your App 2. store the encrypted credentials in env vars

Later on we even launched our own solution for our clients, an app_secrets.yml file, which can be edited via Dashboard. http://help.fortrabbit.com/secrets

The nice thing is, that this file is partly managed by the platform for it's own credentials and partly by the user.

That has been running for a while now. The adaption rate is low until now. It turned out that not everything will fit into that ONE fault. Blackfire.io and NewRelic run as PHP extensions, thus the API-keys are stored with the extension setting.

We have also discussed to implement an some open source "Secret as a Service" but came to the conclusion that this can too easily turn into to be a SPOF.

I am amazed that this topic is getting discussed again and I have learned about many new concepts here.