What is mattwood.fyi?

A live, structured feed of riffs and links from Matt Wood, Chief AI & Technology Officer at AWS — readable by people and queryable by agents as a typed knowledge graph.

Is there an API and is it free?

Yes. A public, read-only query API is available with no authentication and no API keys. See https://mattwood.fyi/openapi.json and https://mattwood.fyi/docs.

How should an AI agent use this site?

Fetch https://mattwood.fyi/feed.json for the full structured feed, or query the API for keyword/semantic search and the connection graph. See https://mattwood.fyi/agents/ for when-to-use guidance.

Secrets Don't Belong in Config

Configuration and secrets have different lifecycles and security requirements—keeping them separate prevents coupling issues. The article analyzes how NixOS modules handle secrets and advocates for dedicated secret interfaces rather than merging them into configuration files.

secretspec.dev →

Connections

Supports

Analyzing Metastable Failures Metastable failures often stem from configuration coupling issues; keeping secrets separate from config reduces a class of failure modes where secret rotation causes cascading config reloads
Lessons I've Learned at Warp Building for Developers Lessons building developer tooling at Warp align with the article's thesis: developer experience improves when secrets management is a first-class concern separated from general configuration rather than bolted on
Cedar Policy Cedar Policy enforces access control through declarative policy separate from application config, exemplifying the principle that security concerns (secrets, permissions) should be decoupled from general configuration

Related to

OpenSSH 10.5 Release Notes OpenSSH 10.5 deals with cryptographic key management and authentication secrets in system configuration—directly relevant to the separation of secrets from config in infrastructure tooling
Exploring AWS DevOps Agent Part 3 - Troubleshooting Issues AWS DevOps agent troubleshooting frequently involves secrets/credentials misconfigured alongside application settings—the lifecycle separation principle the article advocates would prevent common DevOps agent configuration errors
Omarchy: Modern Linux Distribution Omarchy as a modern Linux distribution faces the same NixOS-adjacent problem of secrets management in declarative system configuration—the article's NixOS module analysis directly applies

Supported by

The AI Operating Layer Secrets management best practices ('secrets don't belong in config') are directly relevant to Coder's self-hosted cloud environments where security and compliance are core features

Type:	link
First published:	Monday, 17 August 2026 at 19:13 UTC
Location:	https://secretspec.dev/blog/secrets-dont-belong-in-config/
URL:	https://mattwood.fyi/i/bea989e7

I'm Matt Wood, and this is For Your Information. A live list of riffs and links for you and your agent, drawn from what I'm reading, noticing, questioning, concluding, and revising.

Connections