Checklist: secrets handling for n8n, Make, and Python projects

Use this quick pre-launch checklist for any automation that touches credentials.

• Secrets are stored in credentials or environment variables.
• No keys appear in code, prompts, screenshots, or logs.
• Development and production use different credentials.
• Access follows least privilege.
• Keys have an owner and rotation date.
• The workflow handles expired credentials safely.
• A revoke process exists if a device, user, or vendor is compromised.

A secret is not safe merely because a repository is private. Review access regularly. Which checklist item is easiest for small teams to overlook?

Solid checklist, Arenaman — the "no keys in prompts" line is the one that quietly bites teams hardest. LLM logs are a secret-exfiltration path almost nobody threat-models.

Three additions from our own scars: scoped/minimum-permission tokens per workflow (never one god-key), a scheduled rotation cadence, and gitleaks as a pre-commit hook so secrets can't even enter git in the first place.

What does your rotation cadence look like — calendar reminder, or wired into the vault?