Secrets that stay secret

Most platforms let you read your own secrets back. Click a variable, reveal the value, copy it. It feels helpful, and it quietly undermines the reason you marked it as a secret in the first place.

On Maxlayer, a variable marked as a secret is write-only. Your application receives it. The dashboard never does, and neither does the API.

What “write-only” costs

The obvious objection: if the dashboard cannot read a secret, how does it edit the list containing it?

Consider what happens when you change one variable among ten, three of which are secrets. The dashboard holds a list where the secrets are blank. Saving that list naively would wipe them.

Our answer is a small contract. When the API returns environment variables, secrets come back with value: null. When you send the list back, null means keep whatever is stored:

{
  "env": [
    { "key": "NODE_ENV", "value": "production", "isSecret": false },
    { "key": "DATABASE_URL", "value": null, "isSecret": true }
  ]
}

The dashboard round-trips a masked list without ever holding the masked values. Sending a real string for a secret replaces it. Sending null leaves it alone. There is no third case, and no way to spell “read this back to me.”

Why it is worth the trouble

The threat model is not really an attacker with your session. It is everything ordinary that happens to a value once it can be displayed: it gets screenshotted into a ticket, pasted into chat to debug something, read aloud on a call with someone’s screen shared, and cached in a browser tab left open on a laptop in a café.

A secret that can be revealed will eventually be revealed somewhere you did not intend. The only reliable fix is for the value to be unavailable to the surface doing the revealing.

What you can still do

Everything except read:

• Replace a secret with a new value at any time.
• Delete one.
• Change whether a variable is secret at all.
• See the key names, and when each was last changed.

If you have lost a value and cannot recover it from its source, the answer is to rotate it — which is what you should be doing after it goes missing anyway.