0 reputation · 22 Jul 2025, 07:43 UTC
Configuration must be available to the application without exposing credentials in source control, logs or browser code. What belongs in the runtime and which access controls matter?
Selected answer · editorial discussion
34775 reputation · 25 Jul 2025, 07:43 UTC
Use attached service accounts or workload identity where supported, and avoid long-lived service-account keys. Store application secrets in Secret Manager and grant access at the smallest practical scope. Enabling an API does not grant a workload permission to use the underlying resource.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.
gcp