Security Operations Secrets policy Store runtime secrets in platform secret manager or GitHub Environments. Never commit secrets to repo. Rotate high-impact secrets at least every 90 days: JWT_SECRET EMAIL_APP_PASSWORD CLOUDINARY_API_SECRET social auth secrets Rotate immediately on suspected leak. Access control Use least privilege for CI tokens and deploy credentials. Protect production environment with required reviewers. Restrict who can trigger production workflows. Dependency risk Keep npm audit active in CI. Triage moderate+ findings in each sprint. Pin and update transitive dependencies regularly. Incident response Revoke exposed secret. Redeploy with rotated credentials. Review logs and access history. Document impact and preventive actions in RUNBOOK.md.