Best practices for secret providers

[rgmz]

Compile a list of recommendations for secret providers.

Examples

• Constant (prefix, suffix)
• Minimum entropy
• Checksum

[bradlarsen]

Notable prefix / suffix and well-defined alphabet would be really helpful for secrets detection. A checksum mechanism would further improve signal-to-noise as it could be used to suppress obvious false positives without any network traffic.

Another suggestion for secret providers: provide an safe API endpoint to determine validity.

[bplaxco]

Also something [like GitHub does](https://github.blog/security/application-security/next-evolution-github-advanced-security/ where there's an endpoint for revoking them that emails the owner to let them know their tokens were discovered and revoked would be so handy.