Secure Sensitive Information in Ruby on Rails with Sekrets Gem

Purpose: Eliminate hardcoded credentials by storing secrets in an encrypted file (sekrets.yml.enc) and accessing them securely at runtime.

Target Audience: Rails developers and DevOps engineers securing API keys, database passwords, and tokens in Rails apps.

Definition: Sekrets is a Ruby gem that stores secrets in an encrypted YAML file (sekrets.yml.enc) that is decrypted with a key file (.sekrets.key).

Benefits:

• Prevents committing plaintext secrets to the repository.
• Simple access pattern via SEKRETS[...] in Ruby and ERB in YAML.
• Minimal code changes in existing Rails apps.

Use Cases:

• API keys, DB credentials, webhook tokens, and any secret configuration values.

• Access to the repository and the Rails app.
• Ability to build/run the local dev environment (e.g., Docker Compose).
• The .sekrets.key stored securely outside of the repository (e.g., password manager).

1. Identify credentials to be encrypted (API keys, DB passwords, tokens).
2. Search for hardcoded occurrences in .rb and .yml files.
3. Document each key and preferred fallback value (if any).

1. Flat key-value example:

token: 123456

2. Nested structure example:

slack:
  token: 123456

3. Save and exit; Sekrets re-encrypts the file automatically.

1. Replace hardcoded values with ERB lookups and an optional fallback.

some_service:
  api_key: <%= SEKRETS[:some_service_api_key] || 'fallback-if-missing' %>

2. Notes:
   • <%= ... %> executes Ruby during YAML evaluation.
   • SEKRETS[:key] fetches from sekrets.yml.enc.

1. Flat key:

api_token = SEKRETS[:sensitive_credential] || 'fallback-if-missing'

2. Nested key:

slack_token = SEKRETS[:slack][:token]

3. Loading ERB-enabled YAML in Ruby (if applicable):

config = YAML.load(
  ERB.new(File.read(Rails.root.join('path-of-yml-file'))).result
)[Rails.env].symbolize_keys

1. Verify the files that consume secrets run after Rails initializers.
2. Restart the app/server to load updated configuration.

• SEKRETS[:key] returns nil: Check typos; confirm key exists in sekrets.yml.enc and .sekrets.key is correct.
• Cannot edit sekrets.yml.enc: Ensure .sekrets.key is at repo root during edit; verify gem is installed.

• Store .sekrets.key only in a secure vault/password manager; never commit it.
• Limit access and rotate keys per policy.
• Add secret scanning to CI to prevent regressions.

By shifting secrets to sekrets.yml.enc and referencing them via SEKRETS[...], Rails apps avoid plaintext credentials in source control and achieve a stronger security posture with minimal code change.