I inherited some projects in which secrets were in source control in App.config and similar files. Fortunately it's not a public repository so the risk isn't as serious as it could have been. I'm looking into better ways to manage this, such as Azure KeyVault. (But I don't intend this question to be specific to that solution.)
In general, aren't we just moving the problem? For example, with Azure KeyVault, the app ID and app secret become the things that you need to keep out of source control. Here's an unfortunately typical example of how this tends to go wrong. Other approaches end up being similar, with API keys or keystore files that you have to protect.
It seems to me that products like Azure KeyVault are no better, and pointlessly more complicated, than keeping your secrets in a separate config file and making sure it's in your .gitignore or equivalent. This file would have to be shared as needed via a side channel. Of course, people will probably insecurely email it to each other…
Is there a way to manage secrets that doesn't just move the problem? I believe this question has a single clearly defined answer. By analogy, if I were to ask how HTTPS doesn't just move the problem, the answer would be that CA keys are distributed with your OS, and we trust them because we trust the distribution method of the OS. (Whether we should is a separate question…)
Best Answer
You could say you are just moving the problem. Ultimately, there will have to be a secret stored somewhere that your app has access to in order to have passwords, ssh keys, whatever.
But, if done right, you are moving the problem from somewhere that is hard to secure properly to one you can guard better. For example, putting secrets in a public github repo is pretty much like leaving your house keys taped to your front door. Anybody who wants them won't have trouble finding them. But if you move to, say a key store on an internal network with no outside connectivity you stand a much better chance of keeping your passwords secure. That's more like keeping your keys in your pocket. It's not impossible to lose them (the equivalent of giving out your Azure password for instance), but it limits your exposure vs. taping your keys to your door.