.NET Architecture & System Design Interview Question #160
Why should secrets not be stored in appsettings.json for production?
Security Architecture, Multi-Tenancy & Disaster Recovery Senior Advanced
Quick Interview Answer
Configuration files can be copied, logged, packaged, or committed accidentally. Storing production credentials directly in appsettings.json increases the chance that secrets are exposed with application files or source control.
Detailed Explanation
Configuration files can be copied, logged, packaged, or committed accidentally. Storing production credentials directly in appsettings.json increases the chance that secrets are exposed with application files or source control.
The application can still reference configuration keys, but sensitive production values should come from protected configuration providers, environment-specific secret stores, or workload identity mechanisms.
Code Example
appsettings.json:
"ApiEndpoint": "..."
Secret store:
"PaymentApiKey": <protected secret>