Security and secrets

The Linux Foundation fork of Vault. Dynamic credentials, PKI issuance and leases.

Start with

bao server -dev

The gotcha

Dev mode is in-memory and unsealed. Never let a dev-mode habit reach a real deployment.

Issues attestable SVIDs so workloads prove what they are without a shared secret.

Start with

spire-server run -config server.conf

The gotcha

Attestation policy is the whole security property. A permissive selector makes the rest decorative.

Short-lived certificates for mutual TLS without standing up a full PKI product.

Start with

step ca init && step-ca $(step path)/config/ca.json

The gotcha

step ca init only creates the PKI. The CA has to be running before step ca certificate will issue anything, and short lifetimes mean renewal must be automated on day one, not later.

Pre-commit and in CI. Cheapest control on this page by a wide margin.

Start with

gitleaks detect --source . --redact

The gotcha

Scanning history finds secrets already published. Rotate them; deleting the commit does not help.

Rules that match your own patterns, not just a generic ruleset.

Start with

semgrep --config auto .

The gotcha

It exits 0 even when it finds something, so this command will pass a build that has findings. Add --error when you wire it into CI. The auto config is a starting point, and unfiltered output volume is how scanning gets ignored.

Images, filesystems and dependencies. I run both; they disagree usefully.

Start with

trivy image --severity HIGH,CRITICAL myimage:tag

The gotcha

Severity is not reachability. Triage on whether the path is actually called before you triage on score.

Asking a fleet a precise question without deploying an agent fleet first.

Start with

osqueryi "select * from listening_ports where port != 0;"

The gotcha

Easy to write a query that hammers every host. Test the cost on one before scheduling it.