• Environment Variables may not be great for secrets. Where do they come from?
• Automated infrastructure is nice but security is a problem to solve
• Hard-coding passwords / keys into version-controlled code is a bad idea
• Credentials files are not checked in. But how do you get the file on machines?
• There are a few clever approaches to solving this. But do we need passwords?

4 / 22