keywhiz

Well, our #1 use case is TLS certs, and basically every app supports reading them from a file. For config files with secrets, there's often a way to include another file, or sometimes we just drop the whole config file into Keywhiz. Here's an example from the Keywhiz codebase, of a file that's loaded from disk, but in prod could be swapped for a properly secured secret https://github.com/square/keywhiz/blob/master/server/src/mai... In development, you don't need to run Keywhiz, so you can just write a file on disk, so that's a nice advantage: Less things to depend on.

Square [https://squareup.com/careers] | INTERNS, FULLTIME, VISA, ONSITE | San Francisco, New York & other cities. I'm an engineer on the infosec team and if you are interested in any aspect of security (from hardware/low level stuff to backend infrastructure, writing secure web applications, Android/iOS, etc.) you should consider talking to us! We do have open positions in other teams too. Some of the things we build get open sourced, for example: https://github.com/square/keywhiz, https://github.com/square/go-jose, https://github.com/square/js-jose, etc. Feel free to ask me any questions (email in my profile).