[SECURITY] Implement Secrets Management

[JoshuaAFerguson]

Objective

Move secrets from environment variables to secure secret management.

Options

• HashiCorp Vault
• AWS Secrets Manager
• Azure Key Vault
• Sealed Secrets (K8s)

Secrets to Manage

• Database password
• Redis password
• JWT signing key
• SAML certificates
• API keys
• Webhook secrets

Implementation

import "github.com/hashicorp/vault/api"

func GetSecret(path string) (string, error) {
    client, _ := vault.NewClient(vault.DefaultConfig())
    secret, _ := client.Logical().Read(path)
    return secret.Data["value"].(string), nil
}

Acceptance Criteria

• No secrets in env vars
• Secrets rotated regularly
• Audit trail for secret access
• Documentation updated

Files

• api/internal/secrets/vault.go (NEW)
• manifests/secrets.yaml (update)

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity.

Action Required:

• If this issue is still relevant, please add a comment to keep it open
• If this is blocked, add the status:blocked label
• If this is no longer needed, it will be closed in 7 days

[github-actions]

This issue was automatically closed due to inactivity.

If you believe this was closed in error, please reopen it with a comment explaining why it should remain open.