MeridianMeridian

Centralized Secret Management: Comparing Eight Tools for DevOps and Spring Boot Applications

The article examines the challenges of managing secrets such as passwords, API tokens, and SSH keys across development, CI/CD pipelines, and production environments. It explains how centralized secret registries solve issues like scattered .env files, outdated credentials, and lack of audit trails while emphasizing that delivery mechanisms to applications must be chosen separately. Key concepts including static versus dynamic credentials, leases, rotation, and machine identities are defined to help teams implement least-privilege access. The review compares Infisical, HashiCorp Vault, OpenBao, Doppler, 1Password CLI, Bitwarden Secrets Manager, Passbolt, and Yandex Lockbox across deployment models, offline support, and integration options. Special attention is given to CLI run commands that avoid plaintext files, Spring Cloud Vault integration, and the trade-offs between SaaS convenience and self-hosted control. Practical recommendations focus on separating developer and machine access as well as development and production environments.

HabrTranslated from Russian

Read at source

The article addresses the growing complexity of handling secrets in modern software development. Passwords for test databases often reside in .env files, API tokens sit in CI variables, and production credentials are distributed through corporate password managers. As teams expand, questions arise about access control, copy proliferation, credential updates, and the consequences of access revocation.

Centralized secret storage provides a single source of truth, environment separation, least-privilege policies, audit logging, and lifecycle management. However, simply storing values does not automatically revoke previously downloaded copies or change passwords in target systems such as PostgreSQL.

The piece defines a secret as any value that grants access to resources or allows actions on behalf of a user or application. Configuration elements like service URLs or port numbers are not secrets and can safely remain in repositories. Spring Boot examples illustrate externalized values using placeholders such as ${SPRING_DATASOURCE_PASSWORD}.

Delivery methods are analyzed in detail. CLI run commands launch child processes with secrets injected into the environment. Agents can template files or supervise processes. SDK integrations allow direct API calls, while export options create .env files that should be avoided in production workflows. Tools offering ready-made run scenarios include Infisical, Doppler, 1Password CLI, and Bitwarden Secrets Manager.

Authentication considerations stress the importance of distinct identities for humans and machines. Issuing a single long-lived token to an entire team undermines auditability and revocation capabilities. Environment-specific policies and identity-based authentication are recommended where infrastructure permits.

The comparison table covers placement options (cloud or self-hosted), delivery without plaintext files, and primary use cases. HashiCorp Vault and OpenBao stand out for dynamic credentials and lease management, while Yandex Lockbox integrates tightly with cloud IAM. Licensing differences, offline caching behavior, and Enterprise feature availability are highlighted for each solution.

Practical guidance for Java and Gradle projects includes configuring Spring Cloud Vault with Config Data API imports and selecting compatible versions. The article concludes that tool choice depends on data residency requirements, dynamic credential needs, audit depth, and operational ownership.

OpenBaoHashiCorp VaultInfisicalDopplerBitwarden Secrets ManagerYandex LockboxSpring Cloud Vault
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users
Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users

Mail.ru has begun notifying a small group of long-term Cloud Mail users that their complimentary 1TB storage, originally granted through a 2013-2014 app installation promotion, will be reduced to the standard 8GB free tier. Affected users receive personalized deadlines, with some facing storage limits starting 30 October and final deletion of excess files scheduled for 30 January 2027. The company confirmed the change impacts fewer than 0.5 percent of Cloud Mail users and stated that core free features remain available. Once the 8GB limit is exceeded, uploads, edits, and sharing are blocked while users have three months to download data or purchase additional space before files move to the trash for 14 days prior to permanent removal. This follows a similar reduction of lifetime 100GB storage performed by the service in 2024.

AntiMalwareOct 29, 2026Translated from Russian

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts
Other

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts

Kimi K3 is an open-weights model that outperforms closed systems from GPT and Anthropic on several independent benchmarks. Developers achieved this by scaling three dimensions simultaneously: one million tokens of context, deeper layers, and 896 Mixture-of-Experts specialists. The team replaced the standard KV-cache with a fixed-size state matrix updated via the delta-rule, solving numerical instability by clamping the forgetting coefficient alpha between e^-5 and 1. Sequential state updates were parallelized across chips, GPUs, and multi-GPU nodes using the open-source FlashKDA kernel built on CUTLASS. Inter-layer information flow was preserved through learned pseudo-queries that selectively retrieve relevant outputs from prior blocks rather than passing full activations. Load balancing across 896 routed experts uses per-expert quantile thresholds and a distributed histogram method to guarantee fair token allocation without full sorting.

HabrOct 29, 2026Translated from Russian

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria
Other

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria

Innostage has published the second part of its evaluation of PT NGFW version 1.10.3, focusing on functional capabilities rather than raw performance. The testing covered 156 individual checks grouped into categories such as basic technical features, firewalling, IDS/IPS, web filtering, malware protection, logging, routing, deployment, cryptographic controls and access management. Out of the total, 136 checks passed fully, seven passed with remarks, and 13 did not meet the predefined criteria. Key confirmed functions include high-availability clustering, centralized management via PT-MNGT, AD-based rule application, Site-to-Site VPN, TLS inspection, and Syslog integration with external security systems. Several advanced scenarios, including custom block pages, application risk classification, and centralized software distribution, were not confirmed under the test conditions. The report provides detailed protocol notes that help organizations map product capabilities against their specific infrastructure and regulatory requirements.

HabrOct 29, 2026Translated from Russian