SecretManagement

How credentials are stored and rotated: env vars, vault services, BYOK (user-supplied keys never touching your server).

Why we need this / what value this brings

A leaked API key (yours or a BYOK user's) is one of the highest-impact security failures possible.

When to use this

From day one for your own secrets (DB credentials, provider keys); BYOK requires this design the moment the AI chat feature is built.

How to use or implement this

Store your own secrets in env vars/a secrets manager, never in code; for BYOK, keep the user's key client-side or in a short-lived session, never write it to persistent server storage.

Research questions

• How does BYOK for the AI chat feature avoid ever persisting a user's API key server-side?

---

Empty folder — drop notes, links, and findings here as you research.