API Testing · Senior · Question 67 of 75
What is a safe practice for API tests that need real secrets in CI?
- 1Commit them to the test repository in an encrypted zip file
- 2Inject them from a secret store with least privilege and rotation
- 3Print them in CI logs so failures are easier to debug
Show the answer
Correct answer: Inject them from a secret store with least privilege and rotation
Explanation
Test accounts should have minimal rights, short-lived tokens and be separate from production credentials.