How would you secure secrets and connection strings in an ASP.NET Core application?

Secrets should not be hard-coded in C# files or committed to source control.

During local development, .NET user secrets can store development credentials outside the project. In deployed environments, secrets should come from protected environment variables, managed secret stores such as Azure Key Vault, or another secure configuration provider.

Applications should use least-privilege credentials, rotate secrets, restrict access, protect logs from accidental secret exposure, and prefer managed identities or workload identities where supported so long-lived credentials can be reduced.