Security Skill
Anti Reversing Techniques
Understand anti-reversing, obfuscation, and protection techniques encountered during software…
$15
Secrets Management
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or…
Implements secure secrets management for CI/CD pipelines using HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or native platform solutions, so credentials are never hardcoded and never leak. It covers the full secret lifecycle with a defense-in-depth approach: git leak prevention, encryption at rest, RBAC policies, audit logging, automated rotation, and secret scanning. You move from copying .env files around to a Zero Trust, least-privilege model where every secret has an owner, a scope, and an expiry.
$15 one-time
Add to a kit → Prices include 20% VAT. · Forged on real agency work · one-time, no lock-in
- Type Skill
- Category Security
- Delivery Email · instant
- License One-time
Inside the run · no black box
See the actual work before you buy it.
A credential that never expires is an incident waiting for a date. Secrets move out of the repo, into a vault, into runtime-only injection, and onto rotation schedules with a closed audit trail.
- Get secrets out of the repo first: .gitignore plus a pre-commit TruffleHog scan that blocks any commit containing a credential before it ever leaves the machine.
- Centralize in a vault (HashiCorp Vault or AWS Secrets Manager), encrypted at rest, with least-privilege policies: read-only capability, path-scoped to one environment, dev and prod secrets never share a path.
- Inject into CI/CD at runtime only: vault-action or a get-secret-value call with output masking so values never print to job logs, and each workflow gets its own limited-scope token.
- Make rotation the default state: auto-rotation Lambdas on a 30-day cycle, Vault dynamic secrets with short TTLs that revoke themselves, and an expiry note on every static secret so nothing lives forever.
- Limit blast radius by design: separate keys per project and per environment, short-lived STS tokens over permanent credentials, one database user per service so a single compromise stays single.
- Keep the audit trail closed-loop: every fetch is authenticated and logged (who read what, when), and Kubernetes consumes secrets through External Secrets Operator on a refresh interval instead of baked-in values.
One power source. 6 lines out.
secrets-management · core
core active · 6 lines
- ✓ inject vault or aws secr…
Inject Vault or AWS secrets into GitHub Actions and GitLab CI pipelines
- ✓ set up automated secret
Set up automated secret rotation with AWS Secrets Manager and Lambda
- ✓ enforce least-privilege…
Enforce least-privilege Vault policies scoped per environment and service
- ✓ wire external secrets op…
Wire External Secrets Operator into Kubernetes from a Vault backend
- ✓ add pre-commit and ci se…
Add pre-commit and CI secret scanning to block leaked credentials
- ✓ isolate per-project keys
Isolate per-project keys so one leaked secret has a minimal blast radius
Yours to keep.
Drag time forward. Watch what stays.
Forever
That's what owning means.
The rented stack
ai writing tool: subscription
expired · access lostanalytics suite: subscription
expired · access lostdesign platform: subscription
expired · access lost(nothing left)
Your forge
-
Eliminate hardcoded credentials and the catastrophic cost of a leak
license: perpetual -
Limit blast radius so one compromised secret cannot cascade across services
license: perpetual -
Rotate secrets automatically instead of trusting static, never-expiring keys
license: perpetual -
Prove who accessed what and when with a tamper-evident audit trail
license: perpetual
subscriptions expire · deeds don't
Everything in the box.
Pick a piece up. Watch it work.
HashiCorp Vault setup with KV-v2 engine and AppRole short-lived tokens
6 parts · one working system · ships instantly by email
This wasn't forged for everyone.
- Not for you if you'd rather rent a tool than own one.
- Not for you if you want someone else to run your stack.
- Not for you if you're happy guessing.
For DevOps and platform engineers who need credentials managed across CI/CD and Kubernetes with Zero Trust, least-privilege, and rotation by default.
then this was forged for you.Works with
Universal by design: these run in any AI. Delivered in the open Agent Skills + MCP format (native in Claude); ChatGPT, Gemini, Cursor and Copilot adapt the same files their own way.
- Claude Native format
- ChatGPT Adapts via open standards
- Gemini Adapts via open standards
- Cursor Adapts via open standards
- Copilot Adapts via open standards
Catch what's on your mind.
the air is clear. nothing between you and the forge.
catch a spark: the forge will answer
-
We're a small team without Vault, is this stack overkill for us?
No, the patterns scale down. AWS Secrets Manager, Azure Key Vault, or native platform stores work without running Vault, and the pre-commit TruffleHog scanning applies at any size. Vault with AppRole tokens is one option, not the entry requirement.
-
How does rotation work without breaking running services?
Services read secrets at runtime from the store instead of baked-in env files, so a rotated value propagates without redeploying everything. The skill includes an automated rotation Lambda for AWS Secrets Manager plus a documented manual zero-downtime rotation process.
-
Will it find secrets already leaked in my git history?
No. The TruffleHog hooks block new leaks at pre-commit and in CI, but scrubbing history and revoking already-exposed credentials is incident response, a separate job this skill doesn't perform.
-
How is it delivered?
By email right after purchase: ready to run, downloaded instantly, no setup wait.
-
One-time or subscription?
A one-time purchase; no subscription or hidden fees. VAT (20%) is included.
-
Can I get a refund?
As a digital product, it can’t be refunded once downloaded. That’s why we show exactly what’s inside and who it’s for, right here.