Prasad

Aug 9, 2026

How are you handling secrets rotation without a paid vault?

Small team, Postgres + a Node API, everything on a single cloud provider. Right now our database password and third-party API keys live in environment variables and have not been rotated since we set them up. Managed vaults are the obvious answer but the pricing starts above what this project can justify. What I am considering: 1. The cloud provider's own secret manager — cheap, but ties us to them harder than I would like. 2. SOPS with age keys committed to the repo, decrypted at deploy. 3. Just rotating manually on a calendar reminder and accepting the risk. For those of you running small production systems: what actually works in practice, not in theory? I would rather hear "we do option 3 and it is fine" than a best-practice answer nobody follows.