Your company doesn't have one API key. It probably has dozens — to the payment gateway, the courier, Facebook Ads, Google Ads, the e-commerce platform, the bank, the ERP, GitHub and half a dozen others. The only real question is where they actually sit today.
In most Polish SMEs the answer is uncomfortable: in a Slack message from two years ago, in an Excel file on someone's OneDrive, in a .env file on a server three people have access to (two of whom no longer work there), and in the head of a freelancer who "wires things up" once a week. This works right up until it stops working — and the cost is then wildly out of proportion to the size of the company.
The goal isn't to build a fortress. The goal is to know what you have, where it is, and who can reach it. Without that, every conversation about IT security is a fairy tale.
Where secrets actually live in an SME
Before you start "cleaning up", do an honest inventory. In an SME that never had a secrets policy, keys and service passwords tend to end up in five places.
- Team chats. Slack, Teams, WhatsApp, Signal. "Hey, resend me the Allegro key, mine timed out." That key stays there forever — Slack is searchable, Teams has infinite retention.
- .env files and scripts in a repo. A developer commits
config.production.envwith real values into a private GitHub repo. Private today — public if someone clicks the wrong toggle. - Excel and OneNote. "All passwords and keys — Kate." File password-protected, and that password is also in Slack.
- Application source code. Keys pasted straight into
.cs,.py,.php. During a junior's first public commit in their career — public in a minute. - One person's head. Usually a freelance developer or "our IT guy". They go on holiday or change jobs and the company can't reset its own Google Ads key.
Step one is not buying a tool. Step one is a one-hour meeting where three people write down every system the company connects to over an API or token: payments, couriers, ERP, e-commerce, marketing, bank, cloud, monitoring, backups. That list usually surprises the owner — it's longer than they thought.
What can concretely happen
An API key leak is not theoretical. In the last two years we've seen exactly these scenarios in Polish SMEs:
- Key in a public repo → race of the bots. Automated scanners crawl GitHub 24/7. An AWS or LLM key found in a commit gets used within minutes, before the author notices.
- Ad platform key → someone burns your budget. Campaigns promoting shady sites start overnight. In the morning you see a drained budget and an account blocked by the vendor for "policy violation".
- Bank key (business banking with a payment API) → real financial loss. Rarer, because banks like mBank or ING have extra safeguards, but possible.
- Shipping platform key → generating fake labels at your expense. Well-known in e-commerce, a popular attack vector since 2024.
- Vendor key leak → personal data breach. Your key to the mailing platform gives full access to the recipient database. GDPR, notify the regulator within 72 hours, notify customers.
Common denominator: at the moment of the leak, nobody in the company knows how many keys exist, where they are, or which one to revoke first. An hour of delay can easily cost tens of thousands of złoty.
A concrete example from the field
At one of our clients — a 25-person marketing agency in the Tri-City area running Meta Ads campaigns for end clients — a junior developer committed a config.local.js file into a private GitHub repo, which by accident contained production Facebook Business Manager API keys for three clients. A few days later he flipped the repo to public (wanted to show a colleague a code snippet, forgot about the file).
Between Friday and Saturday night, attackers used one of the keys to launch campaigns promoting fake counterfeit-goods shops. They were burning through 15-18k złoty of the client's daily budget before Meta noticed the anomaly and suspended the account. By the time someone at the agency realised on Monday morning, the loss was 47k złoty. The client — a large sportswear e-commerce shop — demanded reimbursement. The agency paid, because the alternative was losing the contract.
What we did over the next six weeks: an inventory of all secrets (they knew about 71 active keys, the real number was 118), rolled out 1Password Business for 25 accounts, moved application secrets to environment variables in Azure, rotated every discovered key, turned on secret scanning in GitHub (secret scanning + push protection), added an offboarding procedure for freelancers. One-off cost: 18k złoty of services plus about 380 złoty/month for 1Password. It paid back on the first "we didn't have to rotate anything in a panic".
Important: none of these pieces required grand infrastructure. It was healthy habits written down on four sheets of A4 plus one tool that costs less than an intern's salary.
A secrets manager — what to pick
For a Polish SME with 10-50 people, the practical choice is narrow. All the credible options work; the difference is how much of your time each one will consume.
- 1Password Business or Bitwarden Enterprise — for humans. Passwords and keys shared in "vaults" (per team, per client). Simple interface, mobile apps, browser integration. Cost: 20-30 złoty/user/month. Almost always the fastest start for non-technical companies.
- Azure Key Vault or AWS Secrets Manager — for secrets consumed by applications (API keys in code, database passwords). The app fetches the secret at runtime, and the secret never lands in a repo or on a developer's disk. One-off work for a developer.
- HashiCorp Vault, Doppler, Infisical — advanced options. Reasonable when you have several in-house applications and a dedicated DevOps person. Below that scale, it's a cannon aimed at a fly.
The choice is binary: humans need a manager for humans (1Password/Bitwarden), applications need a vault for applications (Key Vault/Secrets Manager). Pushing application keys into 1Password sounds tempting and is an anti-pattern — because the app still needs some way to sign in to 1Password, and the whole problem comes back.
Rotation and hygiene
A secret that was generated once lives forever unless you consciously change it. That's enough to introduce three simple rules and stick to them.
- Rotate at least once a year for critical keys (payments, money providers, providers holding personal data). Google Calendar reminder, two hours per quarter.
- Rotate immediately when a person who has seen a given secret leaves. If it's unclear whether they saw it — treat them as if they did.
- Secret scanner in your repo. GitHub has this built in for free (secret scanning + push protection). Turning it on is three clicks and prevents 90% of junior-developer accidents.
Rotation is boring. That's exactly why it works — it doesn't require heroics, it requires discipline once a quarter.
What to do this week
If you want to move without a huge project, here's the minimum set for the next five working days.
- Call a 60-minute meeting with people who touch external systems: IT, marketing, accounting, e-commerce, developer. On a single page, list every external system the company connects to.
- Mark which keys you've seen in Slack, email or Excel in the last month. That's your first list to clean up.
- Buy 1Password Business or Bitwarden Enterprise on a 90-day trial. Move every service password and key someone keeps in their head or in a spreadsheet.
- Turn on GitHub secret scanning and push protection on every company repo. Three clicks.
- Assign one person to do a 2-hour "secrets review" once a quarter — who left, whose access to revoke, what to rotate.
This isn't a six-month project. It's five days to stop praying nobody clicked the wrong toggle.
An API key leak isn't a question of "if", it's a question of "how much it will cost you". The whole difference is whether, on a Friday evening, you know where that key even was.