SSH keys and API tokens are credentials that live in code, servers and docs — and they leak through Git commits that never forget. This guide shows what never to do, how to store keys in an encrypted vault linked to projects, rotation cadences per service, and an incident response that limits blast radius if a token slips. Secure handling here is the difference between a quick revoke and a client outage.
What Not to Do
Never commit .env, never paste token in Notion, never reuse SSH key across clients. Git history never forgets — leaked token in commit stays forever even after delete. GitGuardian scans find secrets within seconds of push.
Secure Storage Pattern
Vault encrypts SSH private keys and API tokens at rest, categorized by client and project, reveal on click, copy without displaying. Env file references vault ID not value for local dev.
Key Hygiene
Rotate every 90 days, use scoped tokens with minimal permission, separate read versus write, revoke on offboarding. Table maps service to scope and rotation cadence.
Incident Response
If leaked, revoke immediately, generate new, update vault, audit logs for usage, inform client transparently. Speed beats perfection.
Workflow in RunoSO
Store in Vault linked to project repo, link repo in digital assets so credentials, hosting and code stay co-located. Docs at features.
Extra Tips to Compound Results
| Secret | Where NOT to Store | Secure Place | Rotation |
|---|---|---|---|
| SSH private key | Git repo | Vault + local | 90 days |
| API token | Notion page | Vault env link | 60 days |
| DB password | Sheets | Vault per env | 90 days |
Keep Reading
- How to organize your freelance business
- Client management for freelancers
- How freelancers should track income and expenses
Frequently Asked Questions
How do I choose the right system for this topic?
Start with one template and one weekly ritual. Measure for 30 days — if it saves 2 hours weekly, keep it; if not, simplify.
Can I do this with free tools?
You can start free with Sheets and Notion, but linking clients to invoices and vault soon needs a connected OS like RunoSO to avoid duplicate work.
How does RunoSO help here?
RunoSO links clients, projects, invoices, vault and digital assets in one place with GST-ready invoicing and AES-256 vault — see https://www.runoso.in/features.
