How to keep your secrets secret on Netlify

Managing secrets is a critical part of building secure applications. But let’s face it—mistakes happen. Secrets can accidentally find their way into your codebase, your logs, or even your published files. That’s where Netlify’s Secrets Controller steps in, offering a quick way to protect sensitive data for everyone using Netlify.

Watch it in action

Want to see how it works? Check out this quick demo:

Here’s how the Secrets Controller helps you sleep better at night:

1. Environment variables, done right
   
   
   Secrets are stored securely as environment variables, either synced from a vault or added directly in your site settings. They’re delivered in-memory and never exposed in your codebase.




2. Mark secrets for extra security
   
   
   Any environment variable can be flagged as a secret. Once flagged, these values are locked down—hidden from the UI, API, or CLI—ensuring they’re only accessible to your app during runtime.




3. Automatic secret leak detection
   
   
   Mistakes happen, but Netlify has your back. During every build, Secrets Controller scans your repo code and bundled files for any instance where a secret might have been exposed. If it finds one, the build is blocked, and you’re alerted to fix the issue before it goes live.

Even the most careful developers can accidentally expose secrets. Misconfigured build tools, copy-pasting errors, or overlooked logs can lead to serious data breaches. Netlify’s Secrets Controller not only prevents these mistakes but also simplifies your workflow, so you can focus on building, not worrying.

Let’s talk secrets

Have you ever experienced a close call with leaked secrets? How do you handle secrets in your workflows today? Share your thoughts in the comments!