---
title: Secrets management
slug: secrets-management
createdAt: 2026-02-24T04:06:32.047Z
---

Kubegrade should avoid collecting or storing secret values unless strictly required.

### Recommended approach

- Use Kubernetes Secrets only for agent/integration credentials where necessary
- Prefer external secret managers and short-lived credentials
- Scope credentials per workspace/project/integration
- Encrypt secrets at rest
- Redact secrets from logs/UI/audit exports

### Documentation should specify

- Where secrets live (SaaS/on-prem/hybrid differences)
- Rotation procedures
- Revocation procedures
- How to re-authenticate integrations without downtime