Secret
Private information that grants access or reveals something sensitive, such as an API key, password, signing key, or bearer token.
What it is
A secret is any value that should be known only to the people or systems authorized to use it. The label describes how the value must be handled, not one particular format: API keys, credentials, personal access tokens, and private signing material can all be secrets. A secret belongs in controlled storage and delivery paths, never in a committed source file.
How it relates to Orbit
Orbit’s Security audit looks for saved secret patterns, masks evidence, and tracks credential rotation separately from code fixes. See /docs/concepts/security/ for details.
When you would use it
You use the concept of a secret whenever a value could let someone impersonate a service, access private data, or incur cost if it became public.
Common operations
- Identifying secret-bearing values before committing or sharing files.
- Storing active secrets in a Vault and removing them from logs, screenshots, and repository history.