Name: Simplifying and Securing Developer Secrets for Modern Teams
Uploaded: 2025-08-27T17:01:12.952Z
Duration: 23 min 16 s
Description: Simplifying and Securing Developer Secrets for Modern Teams

Transcript for "Simplifying and Securing Developer Secrets for Modern Teams": Hello, guys. Welcome to our welcome to hello, everyone, and welcome to our security builders workshop. My name is Alan Flores, and I work as a threat advisor solutions engineer here at Cloudflare, making sure of maintaining in tip top shape our customers' domain security and performance. In this session, Patrick and I will talk to you about securing developer sequence with Cloudflare. Before we continue, I would let Patrick introduce himself. So go ahead, Patrick. The stage is yours. Thank you, Alan. Very nice to meet you all. Patrick Dretchka, senior solutions architect for our developer platform. Looking forward to speaking to you all about, essentially, our secret store. Thank you so much, Patrick. So with that in mind, let's go ahead and get started. So today's agenda is, reducing these four points, starting with what secrets are, the importance of maintaining them, and clouding and how cluster store secret store can help you with. So let's go ahead to slide 14. Here we go. So first of all, what is a secret? Secrets are variables used by developers to store sensitive information and only authorized users and systems should have access to. Well, exposed secrets are a leading cause of data breaches, and in this this issue has surfaced in countless real world cases. A common scenario involves developers pushing code to repositories without removing hard coded credentials. Attackers and automated bots continuously scan repositories, including previous versions and archive code searching for even, single instance instance where credentials were mistakenly published. It is important to note that this risk isn't limited to public repositories. If private repositories are compromised as well, they can highly expose sensitive credentials. This will mean that the attackers will be granting with the keys to the kingdom. Additionally, there is always the danger of unauthorized individuals within an organization gaining access to secrets they should never have visibility into. So why is securing sick secrets so critical? Developers wants to to focus on application development and performance, and they need an easy way to securely store, manage, and rotate secrets. They want to store it securely once and use it repeatedly across different scripts and applications. Now we have many customers who have thousands of scripts and secrets. They've been asking for this capability, so now they can create and store once and repeatedly repeatedly instead of having to recreate the same secret every script. Another use case is managing access with granular policies. Developers need a simplified method of controlling who can access the application secrets. Some roles may need access to the code but don't know but don't need to know or use the secrets. Some roles may need read access, but not edit or admin access. Perhaps not everyone who has access to a code, for example, a code reviewer, needs to be able to access the so why Cloudflare Secret Store for secret management? Cloudflare secret store is a secure centralized repository for managing sensitive data like API tokens, keys, and credentials with your Cloudflare within your Cloudflare account. Cloudflare is known as a leader in application security and well positioned to provide this capability. We are building a better, more secure Internet, and secrets management is a big part of that. You have our global network and performance, 335 cities across 125 countries and fifty milliseconds from about 95% of the world's Internet connected population. So you're going to get a good performance solution consolidation, one one stop shop secrets without leaving Cloudflare. And you can consolidate with security performance and developer secrets, all with Cloudflare cross product integration to workers today and funds to integrate with other security products in the near future. Why is Cloudflare Secrets, store so important? Well, Cloudflare Secrets will, provide you with improved security security at least, and least privilege. This will this means that encrypted secrets with role based access to minimize risk. Accountability I won't I'm sorry for that. Operational simplicity, centralized management of voice duplication, and speed updates. Accountability and audit auditing. This means that, this will be tracking all changes in usage to meet compliance needs. Also, scalability and future proofing. This is designed to grow with Cloudflare products and organization structures. The last one will be built for developers and security teams. Developers move move faster, security teams to keep full control of it. And now I leave the floor to Patrick. Perfect. Thank you, Alan. Okay. I guess we'll just touch back for a moment here. So do you wanna call out that with Secret Store, you now have a place that's outside just the scope of an individual worker where you can store your secrets. And currently, those secrets can be accessed through workers. They can be accessed through our AI gateway product. That will be expanded further as well over time. But just touching back on everything Alan has said, this this ideally gives you a path where you're able to accelerate your developers. They don't have to create recreate secrets that are shared, like, potentially an API key that's reused across multiple workers, multiple times. They don't have to go through the process of having to then rotate that key multiple times. Instead, they're able to have that secret stored in secret store and have that concern to a degree, minimized to, again, a single interaction point. With the improved RBAC controls, we also have the benefit of just that distributed kind of segmentation of access, segmentation of responsibility there. So, we can have developers access the the, access these secrets, but we can have a separate role for, for a security team to to then to be responsible for editing them, to be responsible for rotating keys without needing to have access to the actual individual worker. So that segmentation becomes important for certain compliance requirements, but also just for, a lot of a lot of kind of best practice there. In addition, security teams will appreciate that there is that audit logging for access, creation, updates, and deletion, which again plays in well with with compliance requirements again. From an operational perspective, you get the benefit of being able to, again, without having to interact with individual workers, make updates that'll span any any secret configuration that's configured across each of those workers within a given, Cloudflare account. Within our demo, we'll see a little bit of that efficiency and the ability to have that update, again, across all of all of the related workers that might be interacting with the value. Okay. Perfect. So as mentioned, we have there that centralized management. We have that role based access control, as well as the scope of segmentation. With the auditing logs, we have that compliance improvement. We have the ability for you to take basically multiple steps in terms of, encryption and key security. So you have both data encryption keys as well as key encryption keys. We also, have basically ensured that once a key is created, there is no, plain text, access available either through the CLI or through the dashboard. We are able to deliver on fast propagation of secrets across our edge network. So regardless of where your worker is going to be invoked from, regardless of where your end users may be using AI gateway from, they're still going to get fast performance of that key being available to Aon Gateway, of that key being available to your worker, as quickly as possible. And finally, we have just a a few more points here. So, secure run time access, these are essentially just the permission checks that follow with worker bindings to ensure that, only configured bindings are able to access keys, similarly with, a similar integration for other services like AI gateway and with more services to come. Currently, in the dashboard, you'll see that you can create, keys for free. In the future, we should see that expand to where you're not only able to create keys within a given security store, but where you'll be able to have multiple security stores for per account. And then this will also be able to provide your own, data encryption keys. So just kind of that bring your own key model for the secret store encryption. We will also essentially potentially look at look at the ability to to make sure that, the integrations across these additional services are are particularly convenient. You have multichannel management, so the ability to interact with those keys, again, through the CLI, through the API, through our dashboard. We have a demo right now that'll take you through how you can interact with them in the dashboard. The interactions through the CLI will be similar as well as through the API. It will be the same, same categories of interactions. We can we can take questions on that just after the, demo right now. And now we'll go through a quick demo of how to interact with Secret Store through the Cloudflare dashboard. Over here in the left hand panel of our account home, we can see secret store as an option. When we go to the secret store page, we can go ahead and click on create secret. We'll be able to provide a name. I'm going to just go ahead and create a placeholder called shared API key. Great. I'm gonna go ahead and just write down seven chars. This can be any plain text value. We'll have this as just demo secret. Perfect. And here, you'll also see that you can set the permission scope. So I'm going to limit this to just workers, but we can also have it enabled for AI gateway, and that'll allow you to provide, keys for whether it's, model providers that you'll be interacting with through AI gateway. Great. So that has just created our shared API key. Now we can create a worker so that we can interact with it. So going back to the account home, we can go ahead and create create application. We'll just go ahead and create a regular hello worker. We will say secret user demo zero and deploy this. We will then be replacing our hello world code. Perfect. Okay. So here, we're just gonna go ahead and replace this with new worker. And going through what this does, we can see it is going to go ahead and look to our bindings to try and grab the API key binding. So we're going to have to create this in order to be able to actually access our key. But let's go ahead and validate this, this error catch right here. So if we try if we deploy this and if we now try to access it, we will see that instead of successfully retrieving our key, we're receiving this error accessing message. So in order to actually enable connectivity to our secrets, we're gonna jump into bindings, click add binding, and go to secret store. And now for adding the binding, we're just gonna go ahead and, here, specify API key. API key will be the value that we reference within our worker within secret name. We're going to pick our existing secret. So that is our shared API key, and we're gonna hit deploy. Okay. That has created the binding for this worker. And if we now go back to the worker we're gonna give it a second to load, and we can see that we have, in fact, gotten our response. So we have status success as key true and key length of our key, which was, seven space pairs, seven. So that is accurate. And now just to also showcase how this looks for, interactions with multiple with with multiple applications at once. So right here, we have three workers that are all configured to access the same key. They are all accessing the same key. And here, we are now going to go ahead and change this key just to show that, any changes to the key will come across all of the workers. So here, we're gonna go ahead and change our value, which used to be seven characters to instead be 13 characters. Great. And we're going to save this. And now with that single deployment, we're going to see that propagate against not just our original, but, in fact, every single one of our applications which are connected to this key. Okay. Excellent. Thank you. I have been muted. Apologies. I was going to say I can see we have a question from Emmanuel in the, q and a. And it says, are there any plans to support any other languages and workers? That would be helpful for those that are not comfortable with JavaScript. And just to call out, so while, TypeScript and JavaScript, I think, do have first class support within workers, we do have additional support available. There is beta support for both Python as well as Rust. Python, there are considerations around, in order to have performance at parity with our TypeScript and JavaScript workers in terms of basically bringing cold start time down to zero. The way Python workers work is that they well, they run on top of the same the same runtime, the same under the hood VA, runtime that runs WebAssembly that the JavaScript and TypeScript workers do, but the Python workers run on top of the PyAdide interpreter. And in order to really match that low basically, instantaneous cold start time, They function through having preborn packages, which means that they have a limited selection of packages currently in support in production, limited to really the standard library as well as some support for line chain as well as fast API. So there is support, but it is not, it is not universal package support within Python, which is a very important distinction. The Rust support, quite quite good. I I I haven't seen many many concerns or limitations regarding the the Rust, runtime there. And I guess worth also calling out, there is also support for WebAssembly bundles in whatever language you might choose. So if you do have functions that you want to execute that are written currently in c plus plus and Java, in any language that you might be able to compile down into WebAssembly, you can package that bundle up with your worker and have, essentially, a worker written in JavaScript or TypeScript then figure off, as as basically the entry point, into into the function that's written stored within that WebAssembly bundle. So there is a kind of flexibility there around which language you bring to to to a given workload. Oh, can you hear me? I sorry, the comments, I guess, were from from earlier. Any additional questions there for either the demo that we saw or any of the value proposition aspects regarding, Secret Store? I will call out to in addition to what we just saw with our workers integration, there is the new integration with AI gateway. So that allows you to basically use secret store to store keys for your individual AI model providers, be they, keys that you might be using with directly with Nantropic, you say you might be using with, that should be key or even through a hyperscaler provider like Bedrock or Vertex. You can opt to store those within Secret Store and then access them within AI Gateway, as you use it for pass through requests. Oh, Emmanuel, I see you've asked the question again. Is do you have another follow-up there? Okay. I I I don't see another question coming there from Emmanuel regarding language support. So I hope that's, to a degree, touched on. With that, do you wanna give a a a warm thank you for for, engagement. Alan, any closing thoughts? Hello. No. No. I'm not on my side. I think, everything was pretty clear for our audience for today. We don't have any more questions. Okay. In that case, thank you, everyone. Please have a great rest of your day. Please, do pay attention. There will be some, resources available, tied to this webinar. We also have AI week happening this week where, we have some exciting announcements regarding updates to our developer platform, new model releases that are, while not tied directly to Secret Store, really do a lot to to basically bring third party models from providers like, Leonardo and Deepgram, to our workers' AI platform. So really compelling updates regarding both image generation as well as, text to speech generation, which, I think given given also just the distributed nature of of Workers AI, can be super compelling for for developer use cases. Thank you all. Thank you. Bye.