# Secrets Management Secrets management is the protection and lifecycle management of credentials such as certificates, keys, passwords, and tokens used by nonhuman users, applications, and IT resources. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How to secure Kubernetes in the age of AI workloads DevFeed: [How to secure Kubernetes in the age of AI workloads]() Original publisher: [Read original article]() Author: Mary Branscombe Published: 2026-06-04T16:45:57Z Content type: article Language: en Sources: [Kubernetes Overview, News and Trends | The New Stack]() Topics: [Kubernetes](), [Artificial Intelligence](), [Azure Kubernetes Service](), [networking](), [zero trust networking](), [Access Control](), [Vulnerabilities](), [Azure](), [Secrets Management]() Tags: [access-control](), [ai](), [ai-agents](), [azure](), [azure-kubernetes-service](), [kubernetes](), [microsoft-azure](), [networking](), [post](), [secrets](), [security](), [sponsor-microsoft-azure](), [sponsored-post](), [vulnerabilities](), [zero-trust]() ### AI overview The article examines how AI workloads and agents increase Kubernetes security challenges through unpredictable processes, traffic, tool use, registry access, and shared GPU infrastructure. It discusses a zero-trust approach and describes AKS network-isolated clusters that can bootstrap without public-internet egress by using private endpoints and Azure Container Registry. ### Source excerpt Securing Kubernetes has always been complex -- spanning access control, image vulnerabilities, secrets management, and networking. AI workloads make it The post How to secure Kubernetes in the age of AI workloads appeared first on The New Stack. ## Build an Authenticated Backend with Ory Network, Encore, and PostgreSQL DevFeed: [Build an Authenticated Backend with Ory Network, Encore, and PostgreSQL]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2026-03-25T00:00:00Z Content type: tutorial Language: en Sources: [Encore Updates]() Topics: [Authentication](), [Back end](), [Open Source](), [Secrets Management](), [PostgreSQL](), [API](), [SDKs]() Tags: [api](), [authentication](), [backend](), [open-source](), [postgresql](), [sdk](), [secrets-management](), [tutorial]() ### AI overview This tutorial shows how to build a backend with Ory Network for user authentication and Encore-managed infrastructure. It covers session verification, protected API endpoints, authenticated user context, secret management, and PostgreSQL data storage. ### Source excerpt Open-source identity with automatic infrastructure ## How to Secure Microservices with SPIFFE and Istio DevFeed: [How to Secure Microservices with SPIFFE and Istio]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeff Ellin, Boris Kurktchiev) Published: 2026-02-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [istio](), [Microservices](), [SPIFFE](), [Zero Trust](), [Authorization](), [Architecture & Design](), [Secrets Management](), [certificates]() Tags: [architecture](), [authorization](), [backend](), [certificates](), [cloud-native](), [firewalls](), [how-to](), [istio](), [kubernetes](), [microservices](), [policies](), [secrets-management](), [security](), [service-mesh](), [spiffe](), [zero-trust]() ### AI overview This guide explains how to secure microservices with SPIFFE identities, Istio service-mesh mTLS, short-lived certificates, and Zero Trust authorization policies. It addresses the limits of network-based trust and long-lived certificates in dynamic Kubernetes environments. ### Source excerpt Learn how to deploy a secure microservices application, configure default-deny authorization policies, and rebuild service connectivity with SPIFFE-based allow rules. ## Building Email Workflows with Inbound and Encore DevFeed: [Building Email Workflows with Inbound and Encore]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2025-12-23T00:00:00Z Content type: tutorial Language: en Sources: [Encore Updates]() Topics: [Back end](), [API](), [SDKs](), [Secrets Management](), [Databases](), [SQL]() Tags: [api](), [backend](), [database](), [email](), [sdk](), [secrets-management](), [sql](), [tutorial](), [webhooks]() ### AI overview A tutorial showing how to build an email-processing backend with Inbound and Encore.ts. It covers sending email through a Resend-compatible SDK, receiving messages through webhooks, securely managing API keys with Encore secrets, and storing incoming emails in a SQL database for conversation tracking. ### Source excerpt Send and receive emails programmatically without running a mail server. ## Resend Integration with Encore.ts DevFeed: [Resend Integration with Encore.ts]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2025-12-10T00:00:00Z Content type: tutorial Language: en Sources: [Encore Updates]() Topics: [API](), [Back end](), [Secrets Management](), [Database](), [React](), [Server]() Tags: [api](), [backend](), [database](), [env-file-security](), [integration](), [secrets-management](), [testing](), [webhooks]() ### AI overview A tutorial showing how to build transactional email functionality with Resend and Encore.ts. It covers sending emails, React Email templates, delivery tracking, webhooks, email-history storage, domain verification, API-key permissions, and secret management. ### Source excerpt Modern transactional emails for developers ## Best Practices for Secretless Engineering Automation DevFeed: [Best Practices for Secretless Engineering Automation]() Original publisher: [Read original article]() Author: jpitts@goteleport.com (Jack Pitts) Published: 2025-11-26T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Automation](), [Secrets Management](), [CI/CD](), [hardcoded credentials](), [AI Agent](), [API keys]() Tags: [agents](), [automation](), [ci-cd](), [credentials](), [engineering](), [secrets](), [secrets-management](), [trust]() ### AI overview This article examines how stored secrets such as passwords, API keys, hardcoded credentials, and long-lived tokens create security and operational barriers for CI/CD and AI-driven engineering automation. It outlines a secretless approach based on cryptographic identity. ### Source excerpt Secure CI/CD, bots, and AI agents without secrets. Learn best practices for delivering safe, efficient, and fully auditable engineering automation. ## Building Clerk Authentication with SSO and PostgreSQL in Encore.ts DevFeed: [Building Clerk Authentication with SSO and PostgreSQL in Encore.ts]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2025-11-19T00:00:00Z Content type: tutorial Language: en Sources: [Encore Updates]() Topics: [Tutorial](), [Authentication](), [Single sign-on (SSO)](), [PostgreSQL](), [Secrets Management](), [Back end](), [OAuth](), [API](), [Docker](), [tracing]() Tags: [auth](), [authentication](), [cloud](), [docker](), [oauth](), [postgresql](), [secrets-management](), [sso](), [tracing](), [tutorial]() ### AI overview This tutorial integrates Clerk authentication with Encore.ts. It covers session verification on protected endpoints, SSO and OAuth, PostgreSQL storage for user preferences, type-safe frontend API clients, secrets management, and local or cloud deployment. ### Source excerpt Production-ready auth with SSO, organizations, and instant deployment ## Replicate Integration with Encore.ts DevFeed: [Replicate Integration with Encore.ts]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2025-11-17T00:00:00Z Content type: tutorial Language: en Sources: [Encore Updates]() Topics: [AI Development](), [text-to-image](), [API](), [flux](), [stable-diffusion](), [Node.js](), [Secrets Management]() Tags: [ai](), [api](), [diffusion](), [flux](), [integration](), [node-js](), [secrets-management](), [stable-diffusion](), [tutorial]() ### AI overview This tutorial explains how to build a type-safe backend with Encore.ts and Replicate to run AI model predictions and generate images. It covers asynchronous results, image storage, API authentication, secret management, and models such as FLUX and Stable Diffusion. ### Source excerpt Running AI models with Replicate and Encore ## BetterAuth Integration with Encore.ts DevFeed: [BetterAuth Integration with Encore.ts]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2025-11-13T00:00:00Z Content type: tutorial Language: en Sources: [Encore Updates]() Topics: [Authentication](), [Tutorial](), [Back end](), [Open Source](), [PostgreSQL](), [TypeScript](), [Secrets Management](), [Docker](), [API](), [OAuth]() Tags: [api](), [authentication](), [backend](), [docker](), [oauth](), [open-source](), [postgresql](), [secrets-management](), [tutorial](), [typescript]() ### AI overview A tutorial for implementing authentication with Better Auth and Encore.ts. It covers a TypeScript authentication backend with email/password and OAuth support, PostgreSQL schema and migrations, automatic local database provisioning, secrets management, mounted auth routes, and request validation for protected endpoints. ### Source excerpt Implementing authentication with BetterAuth and Encore ## How to keep your Postmark account secure: Best practices guide DevFeed: [How to keep your Postmark account secure: Best practices guide]() Original publisher: [Read original article]() Author: Postmark team (fdossetto+postmark@activecampaign.com) Published: 2025-10-21T14:42:00Z Content type: tutorial Language: en Sources: [Postmark (en-US)]() Topics: [Secrets Management](), [Security](), [Application Security](), [API](), [Node.js]() Tags: [api-security](), [application-security](), [authentication](), [deployment](), [engineering](), [error-handling](), [secrets-management](), [security]() ### AI overview This guide explains how to secure Postmark accounts and API tokens using OWASP-aligned practices. It emphasizes validating tokens, securing configuration and deployment processes, validating data, preventing credential leaks in error messages, and storing credentials in dedicated secrets management tools rather than code repositories. ### Source excerpt Your Postmark API tokens are the keys to your email kingdom. One exposed token can mean unauthorized access to your account, potential data breaches, and a whole lot of stress you don't need. The good news? Keeping your account secure doesn't have to be complicated. This guide covers the essential practices that'll help you sleep better at night, knowing your Postmark credentials are locked down tight. Following Industry Standards: OWASP Guidelines When it comes to web application security, you don't have to reinvent the wheel. The Open Web Application Security Project (OWASP) provides comprehensive, industry-standard guidance that's trusted by security professionals worldwide. The OWASP Web Security Testing Guide The OWASP Web Security Testing Guide is an essential resource for developers who want to build secure applications. While it covers much more than just secret management, several sections are particularly relevant to protecting your Postmark credentials: Key areas that apply to API security: Authentication Testing - Ensuring your API tokens are properly validated Configuration and Deployment Management Testing - Securing your deployment pipeline Data Validation Testing - Validating inputs that might expose credentials Error Handling - Ensuring error messages don't leak sensitive information Applying OWASP Principles to Your Email Infrastructure Here's how OWASP best practices translate to protecting your Postmark setup: Secure Configuration Management: Follow OWASP's guidance on configuration security by keeping all sensitive Postmark credentials in dedicated secrets management tools, never in code repositories. Why OWASP Matters for Email Security Email infrastructure is often overlooked in security assessments, but it's a critical attack vector. A compromised email service can lead to: Account takeover attacks through password reset emails Data exfiltration via email forwarding Social engineering attacks using legitimate email channels Compliance violati ## Nix Weekly Recap: 2024-03-24 DevFeed: [Nix Weekly Recap: 2024-03-24]() Original publisher: [Read original article]() Published: 2024-03-24T00:00:00Z Content type: article Language: en Sources: [nixpkgs.news]() Topics: [Nix](), [Rust](), [Secrets Management](), [migration](), [Security](), [modules](), [patches]() Tags: [announcements](), [migration](), [modules](), [patches](), [recap](), [release](), [secrets-management](), [security](), [weekly]() ### AI overview A weekly recap of Nix community activity covering the Devenv 1.0 rewrite from Python to Rust, NixOS secrets-management materials, new packages and modules, and security fixes. ### Source excerpt Weekly recap of the announcements and activity in the Nix community and on the NixPkgs package repository. ## Year in Review 2023 DevFeed: [Year in Review 2023]() Original publisher: [Read original article]() Author: Marcus Kohlberg Published: 2024-01-04T00:00:00Z Content type: article Language: en Sources: [Encore Updates]() Topics: [releases](), [Secrets Management](), [observability](), [Monitoring](), [OpenAPI Specification](), [Grafana](), [datadog]() Tags: [datadog](), [engineering](), [grafana](), [monitoring](), [observability](), [openapi-specification](), [releases](), [secrets-management](), [year-in-review]() ### AI overview Encore's 2023 year-in-review highlights product releases and engineering blog posts, including expanded secrets management, built-in application metrics, observability integrations, an API documentation Service Catalog, OpenAPI client generation, Pub/Sub improvements, and cloud infrastructure configuration. ### Source excerpt Our best new releases and engineering blogs in 2023 ## CodeSecDays conference and more complete security coverage with GitGuardian DevFeed: [CodeSecDays conference and more complete security coverage with GitGuardian]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2023-08-10T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [supply-chain-security](), [open-source-security](), [Secrets Management](), [Tooling]() Tags: [acquisition](), [awareness](), [blog](), [ci-cd](), [developer](), [devops](), [gitguardian](), [pmm](), [related-content](), [secrel](), [secrets-management](), [security](), [snyk](), [snyk-platform](), [software-supply-chain-security](), [supply-chain-security](), [vulnerabilities]() ### AI overview Snyk describes its partnership with GitGuardian and its participation in the CodeSecDays digital conference. The article summarizes panel guidance on reducing silos between development and security teams, integrating security tooling into workflows, training developers, and improving software supply chain security incrementally. ### Source excerpt Snyk partners with GitGuardian to offer more complete security coverage and speaks at the company's new digital CodeSecDays conference. ## External Secrets Operator Accepted into the CNCF Sandbox DevFeed: [External Secrets Operator Accepted into the CNCF Sandbox]() Original publisher: [Read original article]() Author: charles.humble@container-solutions.com (Charles Humble) Published: 2022-08-16T08:01:51Z Content type: news Language: en Sources: [Blog - Container Solutions]() Topics: [Cloud Native Ecosystem](), [Kubernetes](), [Secrets Management](), [Open Source](), [Go Language]() Tags: [cloud-native](), [cncf](), [kubernetes](), [news](), [open-source](), [operator](), [secrets]() ### AI overview External Secrets Operator, an open-source Kubernetes operator for synchronizing secrets from external APIs, was accepted into the CNCF Sandbox for early-stage incubation. ### Source excerpt The Cloud Native Computing Foundation (CNCF) has announced that External Secrets Operator (ESO), an open-source solution for synchronising secrets from external APIs into Kubernetes, can begin incubating as an early stage project in the CNCF Sandbox. ## AWS OIDC Authentication with SPIFFE DevFeed: [AWS OIDC Authentication with SPIFFE]() Original publisher: [Read original article]() Author: Roy Xu Published: 2021-08-26T19:00:00Z Content type: tutorial Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Amazon Web Services](), [OpenID connect (OIDC)](), [SPIFFE](), [SPIRE](), [Security](), [Secrets Management](), [Authentication](), [datacenter](), [Amazon S3](), [Amazon Simple Queue Service (SQS)](), [migration]() Tags: [app](), [authorization](), [automated](), [aws](), [cloud](), [datacenter](), [engineering](), [kubernetes](), [oidc](), [s3](), [secrets-management](), [security](), [spiffe](), [spire](), [sqs]() ### AI overview Square describes using SPIFFE and SPIRE's OIDC Discovery Provider to exchange SPIFFE JWTs for AWS credentials, allowing datacenter applications to assume AWS roles through an automated configuration-based process. ### Source excerpt Easy authentication with automated AWS credentials ## Using AWS Lambda Extensions to Accelerate AWS Secrets Manager Access DevFeed: [Using AWS Lambda Extensions to Accelerate AWS Secrets Manager Access]() Original publisher: [Read original article]() Author: Michael Weissbacher Published: 2020-10-08T17:00:00Z Content type: tutorial Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Extension](), [Secrets Management](), [AWS Lambda](), [Amazon Web Services](), [Developer experience](), [Amazon Bedrock]() Tags: [aws](), [aws-lambda](), [developer-experience](), [engineering](), [extensions](), [performance](), [secrets](), [secrets-management](), [serverless]() ### AI overview This article explains how Square built and open sourced an AWS Lambda Extension that prefetches secrets from AWS Secrets Manager. It describes the extension lifecycle and reports a 500 ms speedup in experiments compared with fetching three secrets from a baseline Lambda function. ### Source excerpt Making serverless faster using AWS Lambda Extensions ## Secrets Management for AWS Powered Serverless Applications DevFeed: [Secrets Management for AWS Powered Serverless Applications]() Original publisher: [Read original article]() Author: Gareth McCumskey Published: 2019-08-02T00:00:00Z Content type: article Language: en Sources: [Serverless Blog]() Topics: [Serverless](), [Secrets Management](), [Amazon Web Services](), [App]() Tags: [applications](), [aws](), [aws-lambda](), [cloud-computing](), [engineering](), [faas](), [function-as-a-service](), [infrastructure-as-code](), [secrets-management](), [serverless](), [serverless-architecture](), [serverless-framework]() ### AI overview The article discusses managing application secrets in AWS-powered serverless applications and notes that approaches to doing so are often contradictory. ### Source excerpt Storing application secrets in serverless applications is a hot topic that provokes many (often contradictory) opinions on how to manage them right. ## Serverless Framework - Now, Full Lifecycle DevFeed: [Serverless Framework - Now, Full Lifecycle]() Original publisher: [Read original article]() Author: Austen Collins Published: 2019-07-22T00:00:00Z Content type: release Language: en Sources: [Serverless Blog]() Topics: [serverless framework](), [Monitoring](), [real-time](), [Secrets Management](), [Security](), [Testing]() Tags: [aws](), [aws-lambda](), [cloud-computing](), [faas](), [free](), [function-as-a-service](), [infrastructure-as-code](), [monitoring](), [news](), [real-time](), [secrets-management](), [security](), [serverless](), [serverless-architecture](), [serverless-framework](), [testing]() ### AI overview The Serverless Framework adds real-time monitoring, testing, secrets management, and security features in a unified experience, and makes these features free. ### Source excerpt Now, the Serverless Framework includes real-time monitoring, testing, secrets management and security features, in a single, unified experience. All of which are now free. ## Managing Secrets and Output Variables With Serverless Framework Enterprise DevFeed: [Managing Secrets and Output Variables With Serverless Framework Enterprise]() Original publisher: [Read original article]() Author: Maciej Skierkowski Published: 2019-06-28T00:00:00Z Content type: release Language: en Sources: [Serverless Blog]() Topics: [serverless framework](), [Secrets Management](), [Framework]() Tags: [aws](), [aws-lambda](), [cloud-computing](), [faas](), [function-as-a-service](), [infrastructure-as-code](), [news](), [release](), [secrets-management](), [serverless](), [serverless-architecture](), [serverless-framework]() ### AI overview Serverless Framework Enterprise v0.11.0 adds support for output variables and secrets management. ### Source excerpt With the Serverless Framework Enterprise v0.11.0 release, we are adding support for output variables and secrets management