V13.3.1: Verify that a secrets management solution, such as a key vault, is used to securely create, store, control access to, and destroy backend secrets. These could include passwords, key material, integrations with databases and third-party systems, keys and seeds for time-based tokens, other internal secrets, and API keys. Secrets must not be included in application source code or included in build artifacts. For an L3 application, this must involve a hardware-backed solution such as an HSM.
ASVS Maturity
V13.3.2
V13.3.2: Verify that access to secret assets adheres to the principle of least privilege.
ASVS Maturity
V13.3.3
V13.3.3: Verify that all cryptographic operations are performed using an isolated security module (such as a vault or hardware security module) to securely manage and protect key material from exposure outside of the security module.
ASVS Maturity
V13.3.4
V13.3.4: Verify that secrets are configured to expire and be rotated based on the application's documentation.