Secrets Management Survival Guide

How to read this

Updated 12 May 2026

This site is a structured field guide. It is not a wiki, not a traditional blog, and not a documentation site — though it borrows something from each. The website format is for easy navigation and cross-referencing, but it reads like a book — and like a book, it will demand your attention. It’s long because the problem deserves it.

It is built around three kinds of content that serve different reading modes.

The manual

The manual is for reading in order. Each page builds on the last. Start at the beginning if you want to understand the whole subject from the ground up, or navigate to a specific chapter if you already know what you need.

The manual is recursive in two ways.

First, in how it is read. The same ground is covered four times, each pass with a different question in mind:

  • The overview asks: what does this feel like? A short walk-through of the whole system, written for intuition. It is the closing chapter of this introduction.
  • The non-technical pass asks: what do I actually do? Concrete setup and operation, written for someone who is not a computer person.
  • The technical pass asks: why does each piece work the way it does, and how does it fail? It is for the computer-wiz helping someone set this up, and for anyone who wants to adapt the defaults to their own situation.
  • The advanced pass asks: when do I deviate from the defaults? Hardening, higher-stakes situations, and the cases where good-enough is not enough.

This means the same fact may show up in all four passes — for example, “your offline vault lives on a USB you only plug into an air-gapped laptop” is mentioned in the overview, set up step-by-step in the non-technical pass, justified in the technical pass, and hardened in the advanced pass. Each pass earns its repetition by changing the question.

Second, in how it is implemented. You do not need to finish the whole guide before the protocol starts protecting you — and you will not finish it on a Sunday afternoon either. Think of this less like assembling a piece of furniture — one rainy weekend, one finished object — and more like owning a home. You move in, you live there, and you improve it over time. You patch the roof one year, rewire the kitchen the next, plant the garden when the season is right. At every point it is shelter — it does its job — and at every point there is something you could be doing to make it better. The work is never quite finished, and that is not a bug. It is what stewardship of anything important looks like.

The manual is designed for that pattern. The first pass gives you the whole house in broad brush strokes — a working version of every part of the system, even if some pieces are crude. Each later pass offers concrete upgrades: a stronger backup scheme, a sturdier recovery plan, a more resilient circle of trust. Risk drops with each iteration, but you are protected from the day you move in. A rough version of the whole thing beats a perfect version of half of it.

To make moving in possible at all, the guide allows for temporary steps — the tarps and plywood of digital security, used when you do not yet have the right hardware, the right people, or the right time to do something properly. A trusted friend instead of a fully briefed circle of trust. A written piece of paper in a drawer instead of a sealed envelope with a lawyer. These shortcuts carry real risk — but it is bounded, temporary risk, taken with eyes open and with a clear plan to retire it. And in almost every case, that risk is dwarfed by the alternative: doing nothing, or living in a house that was never built for shelter in the first place. Where the guide offers a temporary step, it will say so explicitly, and it will tell you what the permanent version looks like and how to get there.

These same temporary steps can also become permanent ones if you choose — the tarp left up by design, a conscious trade of risk for convenience. The guide will not stop you. What it gives you is the language to make that trade deliberately rather than by accident, which is itself a large improvement over the status quo. That said: I would gently encourage you to keep pushing toward the full version wherever you reasonably can. Each upgrade closes a door that, on a long enough timeline, something or someone would otherwise walk through.

The reference section

The reference section is for looking things up. Entries are self-contained: a comparison table, a glossary definition, a template you can copy. Dip in when you need something specific; you do not need to have read the manual first.

Key terms are referenced in the Glossary section. You can use the “backlinks” to navigate to the pages where the terms are used.

Posts

The core of the guide in the field manual is not expected to change much. The posts are the place where I can add additional reading material as time marches on. The are completely optional and they are mostly aimed at technical people.

Where to start

TODO: Can only write this section once the manual is complete. The idea is that the four types of readers named on the landing page are now directed. All uninitiated readers can move on the to the overview section next for an introduction.