May 2025 Summaries

May has come and gone already, bringing smoother approvals and smarter defaults to Doppler. The company is now helping teams move faster with the introduction of auto-assigned reviewers in Change Request Policies. This feature ensures that the right people are automatically added to every change request, saving time and maintaining consistent approvals. Additionally, Doppler continues to improve its secrets management capabilities, providing trusted solutions for DevOps and security teams.

Doppler, a purpose-built tool, integrates cloud-native secrets management solutions to address challenges in multi-cloud environments, including cross-compatibility, configuration drift, and duplicate secrets. Traditional secrets managers are unwieldy and static, requiring significant resources to design, create, and maintain effectively. Cloud-native secrets managers provided by major cloud providers lack integration with other cloud providers, making them unsuitable for enterprise-level secrets management in a multi-cloud environment. Doppler offers workflows to solve modern secrets management challenges and was designed to operate in multi-cloud environments at any scale.

Non-human identities like service accounts, API keys, and machine tokens are increasingly used in systems, outnumbering human ones. The OWASP top 10 list of 2025 highlights critical security risks tied to these non-human identities, including access left open, secrets reused, credentials exposed, old tokens lingering quietly, leaked secrets opening the door to full system compromise, third-party tools becoming a foothold for attackers, outdated authentication methods exposing systems, overprivileged service accounts causing greater blast radius when compromised, CI/CD pipelines relying on service accounts being high-value targets, long-lived secrets living far longer than they should, reusing non-human identities across environments multiplying the blast radius, and non-human identities being used for automation rather than manual work. To confront these risks, teams should adopt a robust approach including inventory assessments, threat detection and response planning, zero trust principles, compliance enforcement, security training for staff, clearly defined lifecycle policies, regular strategy reviews, monitoring and auditing activity, and frequent threat assessments to confirm that non-human identities remain safe.

Non-human identities are ubiquitous in modern infrastructure, yet often unmanaged, creating blind spots in zero-trust environments. This creates a security risk as these digital identities authenticate, connect, and automate behind the scenes, outnumbering human users by a wide margin. Zero-trust architecture assumes no one should be trusted by default, requiring every user, device, or system to prove who they are and access requested resources. However, it usually doesn't account for non-human identities, which handle majority of system-to-system communication in cloud-native infrastructures. Ignoring them breaks zero-trust at its foundation, implicitly trusting machines to operate without verification. Managing non-human identities requires strict access controls, automation, and short-lived access to maintain a true zero-trust posture. Solutions include continuously monitoring their behavior, building baselines for normal behavior, eliminating long-lived secrets, enforcing least privilege access, and leveraging automation tools like dedicated secrets management to handle credential issuance and rotation.

Strong governance is essential for managing secrets like API keys, database credentials, and encryption keys to ensure control, visibility, and best practices are followed without slowing development. Without it, teams risk exposing sensitive data, violating compliance requirements, and introducing operational inefficiencies. A modern approach to secrets governance enforces access control, auditability, and automated secret rotation while integrating directly into engineering workflows, resulting in stronger security, reduced operational overhead, and a scalable approach to managing sensitive data.

Hackers are constantly looking for ways to exploit weak or exposed secrets, which can lead to unauthorized access into a system. To mitigate this risk, security professionals recommend rotating secrets "frequently" but acknowledge that no concrete number of rotations works in all situations, leaving developers to make judgment calls on the correct frequency. In cases where an unscheduled secret rotation is necessary, having a list of all secrets in use and access information can help mitigate the situation. A secrets management tool can also be helpful in quickly rotating secrets in emergency situations. Regular rotation makes security proactive rather than reactive, but the ideal frequency depends on the criticality of the service being protected. Bucketing secrets into timeframes such as hourly, daily, weekly, monthly, quarterly, etc., and creating a schedule for rotation can help ensure that secrets are rotated regularly and securely. Ultimately, having a policy around secret rotation and using automated tools like Doppler can make it easier to manage and rotate secrets effectively.

Rotated secrets are long-lived credentials that get replaced with new ones at a set interval, offering improved control and stability. They are best suited for workloads that require continuous operation and are shared by multiple workload instances. Dynamic secrets, on the other hand, provide temporary access to resources and are generated on demand with a limited lifespan, helping prevent secret sprawl. The choice between rotated and dynamic secrets depends on systems, workflows, and security needs, and combining both approaches can provide more robust protection in many cases.

The widespread exposure of sensitive credentials across major technology companies has highlighted a growing challenge in managing secrets at scale. The impact of such exposures continues to grow, with over 11,000 unique secrets exposed in package releases alone throughout 2023. Traditional self-hosted solutions struggle to keep pace with modern security demands, and the complexity of securing secrets grows exponentially as organizations scale their cloud operations. Managed solutions are redefining how we approach secrets security, providing sophisticated security approaches far beyond simple encrypted storage. These solutions offer features such as automated rotation, real-time monitoring, and intelligent access control, which are essential for modern infrastructure security. Organizations that have adopted managed secrets solutions report significant improvements in their security operations, including compliance and audit benefits, and are elevating their security posture by leveraging advanced features like automated rotation and real-time monitoring.

Manually managing secrets in Kubernetes can be risky and time-consuming, but integrating Doppler's Kubernetes Operator can automatically sync secure, up-to-date secrets into your cluster using native K8s Secret objects. This integration provides a single source of truth for secret updates, reduces manual effort and the risk of stale secrets, and leverages Doppler's robust role-based access controls to manage who can view or modify secrets. The Doppler Kubernetes Operator handles synchronization automatically, fetching secrets dynamically and injecting them into the cluster without exposing them in Git repositories or Docker images. By automating secrets management, developers can focus on building features, knowing that the correct, up-to-date secrets are securely and automatically available in their Kubernetes environments.

Automating secrets management can significantly reduce manual errors, simplify collaboration, and ensure that secrets are always up-to-date across environments, allowing developers to focus on writing code and building features. This is achieved by shifting from manual processes to automated key aspects like secrets rotation, access control, and sync across environments, resulting in substantial time savings and productivity boosts for development teams. By centralizing secrets management, teams can enhance collaboration, improve security, and comply with regulations, ultimately strengthening their overall security posture.