Environment Variables and Secrets

Secrets in Heroku config vars — not in source code; access restricted per environment and mandatory 2FA

Principle

All secrets and credentials for the SSM.ro application are stored exclusively in Heroku config vars (environment variables managed at the Heroku application level). No secret is embedded in the source code or in the GitHub repository.

What Is Stored in Config Vars

Secret category	Content
Databases	Postgres and Redis connection URL (per environment)
Email services	Postmark server token
Electronic signature	Electronic signature provider credentials (mTLS client certificate or API token)
Observability	New Relic account key, Sentry DSN
AWS	IAM credentials for S3 and CloudWatch access (least-privilege)
Application session	Session cryptographic key (per environment)
Other integrations	Any other API token or service key

Separation per Environment

Production and staging have fully separate sets of config vars:

Production credentials are never used in staging
Staging uses distinct service instances (Postgres, Redis, Postmark sandbox, etc.)

Access to Config Vars

Access to Heroku config vars is controlled through:

Mandatory 2FA on the administrative Heroku account
Access restricted to team members with an administrative role on the Heroku application
No secret appears in logs or build output

Secret Rotation

In the event of credential compromise, the procedure includes:

Immediate rotation of all affected secrets (Heroku config vars, AWS keys, Postmark/electronic signature provider tokens)
Updating in all affected environments
Verifying that old credentials are no longer functional

Protection Against Accidental Exposure

Branch protection on GitHub: no direct merge into main without PR review — reduces the risk of a secret being accidentally committed
2FA on GitHub: mandatory on accounts with repository access
Secrets are not logged in application or CI/CD output

Best Practices Applied

Least-privilege principle: AWS credentials have the minimum permissions required (S3 access restricted to the application's bucket, CloudWatch write-only)
Separate credentials per provider: Postmark, the electronic signature provider, New Relic, and Sentry have dedicated tokens, not shared credentials
Scoped tokens per environment: the Postmark server token for production differs from the one used for staging