# Alternatives to app secrets

Source: https://docs.fortrabbit.com/platform/new/changes/app-secrets
Published: 2026-10-23
Updated: 2026-10-23
Reviewed: 2026-10-23

> The new fortrabbit platform has no app secrets. Store secrets as ENV vars, in CI, in a secrets manager, or encrypted, with a tested PHP example.


App secrets on the old platform stored security-sensitive config as key-value pairs in a JSON file, separate from the ENV vars. Few apps used them, and they caused confusion, so the new platform has no app secrets.

## Alternatives for app secrets

- Store secrets as [ENV vars](/platform/settings/env-vars). Keep the values out of logs and error output, see [ENV vars and security](/dev/env-vars/security).
- Deploy a secrets file not tracked in Git via rsync or SSH as a one-off step outside the normal deploy flow.
- If your CI/CD pipeline handles deploys, inject secrets there — GitHub Actions, GitLab CI, and Bitbucket Pipelines all have built-in secret storage.
- Use a dedicated commercial secrets manager: [Doppler](https://www.doppler.com), [HashiCorp Vault](https://www.vaultproject.io), [Infisical](https://infisical.com), or [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) are common choices.
- Encrypt individual secret values and store them as env vars. Encrypted values are safe to expose; only the key needs protecting. We wrote about this pattern in [how to keep a secret](https://blog.fortrabbit.com/how-to-keep-a-secret). For plain PHP use [`defuse/php-encryption`](https://github.com/defuse/php-encryption); Laravel has this built in via the `Crypt` facade and `php artisan env:encrypt`; Symfony offers a [secrets vault](https://symfony.com/doc/current/configuration/secrets.html) with `php bin/console secrets:set`.

## Encrypted ENV vars in plain PHP

This example uses `defuse/php-encryption`. Install the package:



```shell
composer require defuse/php-encryption
```

Generate a key once and save it outside of Git, for example in a file uploaded by SFTP:



```shell
php -r "echo \Defuse\Crypto\Key::createNewRandomKey()->saveToAsciiSafeString();"
```

Encrypt each secret locally and store the output, prefixed with `ENC:`, as an ENV var:



```php
$key = \Defuse\Crypto\Key::loadFromAsciiSafeString(trim(file_get_contents('/path/to/app.key')));
echo 'ENC:' . \Defuse\Crypto\Crypto::encrypt('my-secret-value', $key);
```

At bootstrap, decrypt every ENV var with the `ENC:` prefix. `getenv()` reads the ENV vars also when PHP leaves `$_ENV` empty:



```php
$key = \Defuse\Crypto\Key::loadFromAsciiSafeString(trim(file_get_contents('/path/to/app.key')));
foreach (getenv() as $name => $value) {
    if (str_starts_with($value, 'ENC:')) {
        $_ENV[$name] = \Defuse\Crypto\Crypto::decrypt(substr($value, 4), $key);
    }
}
```

---

- [ENV vars](/platform/settings/env-vars)
- [What's new](/platform/new/changes/whats-new)