---
title: "Where secrets go · Ruslan Akchurin"
canonical_url: https://ruslanakchurin.dev/blog/where-secrets-go
description: "A store gives a secret a place to rest, but the value itself still has to arrive: enter under control, reach the runtime, build, deployment, and local-development surfaces, and leave evidence that live state still matches what was declared. This series names that route as one delivery transaction, reviewable before it scatters across console clicks, scripts, and build credentials nobody wants to call the authority."
series: where-secrets-go
seriesName: "Where secrets go"
---

# Where secrets go

A store gives a secret a place to rest, but the value itself still has to arrive: enter under control, reach the runtime, build, deployment, and local-development surfaces, and leave evidence that live state still matches what was declared. This series names that route as one delivery transaction, reviewable before it scatters across console clicks, scripts, and build credentials nobody wants to call the authority.

## Parts

- Part 1 — [A secret has to arrive](https://ruslanakchurin.dev/blog/where-secrets-go/01-a-secret-has-to-arrive) — Secret storage gives a value somewhere to rest; secret delivery records the route, authority, wiring, and proof that get it there.
- Part 2 — [Delivery is a transaction](https://ruslanakchurin.dev/blog/where-secrets-go/02-delivery-is-a-transaction) — Secret delivery breaks when writes, wiring, and receipts are separate chores; the transaction is the unit that keeps partial success and proof limits visible.
- Part 3 — [The bundle is the competitor](https://ruslanakchurin.dev/blog/where-secrets-go/03-the-bundle-is-the-competitor) — The working bundle around a secret store can deliver a value; rotation, revocation, and honest proof limits are what test whether it delivers one verifiable transaction or evidence held together by convention.