Lion Cipher Lab
Get secrets out of your code with SOPS + age (a real secrets manager)
- AppSec / DevSecOps
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A 'secret' is any value that proves who you are or unlocks something — an API key, a database password, a token. Hardcoding one in your code is the single most common way credentials leak, because the moment that code is pushed anywhere, the secret is out of your hands. A .gitignore'd .env keeps it out of git, but it's still a plaintext file one bad copy-paste away from exposure, and it can't be shared with a teammate safely. A secrets manager fixes this: the secret lives encrypted, and only decrypts at the moment a program needs it. SOPS + age do this with zero infrastructure and zero cost —…
What you'll learn
- Secrets management
- File encryption with age (public/private keypairs)
- SOPS (encrypting only the values in YAML/JSON/env files)
- Injecting secrets into a program at runtime instead of hardcoding them
- Key and secret rotation
- Understanding why a leaked secret must be rotated, not just deleted
Steps in this lab
- The problem, and what SOPS + age actually do
- Install age and SOPS
- Generate an age keypair (your lock and your key)
- Make a tiny project with a hardcoded secret — the thing we're fixing
- Tell SOPS which key to use, then encrypt the secret
- Take the secret OUT of the code and pull it back at runtime
- Commit safely — encrypted file yes, private key NEVER
- Rotation — the part everyone skips
- Why a committed secret is so hard to undo
- What you just did — and where it fits