[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572216-105":53,"doc-detail-572216-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","extended-version-it-should-be-easy-but-new-users-experiences-and-challenges-with-secret-management-tools","Extended Version - It Should Be Easy but... New Users’ Experiences and Challenges with Secret Management Tools","","Software developers face real risks of leaking software secrets such as API keys and passwords, causing substantial security and organizational harm. Secret management tools (SMTs) like HashiCorp Vault Secrets and Infisical are widely recommended for centralized, secure handling, yet leaks remain common and new developers report difficulty setting up and using them. Existing help resources may not translate into effective onboarding and quick adoption. A qualitative two-step study observed 21 new users performing storage/access and injection tasks with assistance from help resources.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/extended-version-it-should-be-easy-but-new-users-experiences-and-challenges-with-secret-management-tools/572216/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/extended-version-it-should-be-easy-but-new-users-experiences-and-challenges-with-secret-management-tools/572216.png","ImageObject",442,249,{"name":88,"@type":89},"Cipher","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":79},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"Why do secret management tools remain challenging for new developers?","Question",{"text":108,"@type":109},"Even when SMTs provide public help resources, new users still report difficulty learning how to set up and use SMTs effectively, especially under conditions where documentation is insufficient.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What did the qualitative study observe about new users using SMTs?",{"text":113,"@type":109},"The study observed 21 new users performing two tasks—secret storage and access, then secret injection—and interviewed them after each task to identify challenges and experiences while using help resources.",{"name":115,"@type":106,"acceptedAnswer":116},"How can insufficient documentation affect developers’ behavior and security outcomes?",{"text":117,"@type":109},"Insufficient tool documentation can lead users to deviate from official guidance, consult secondary sources, or attempt workarounds, making it harder to securely remediate hard-coded secrets.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},572216,1792316473,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":79,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":35,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":140},687208528416,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","Extended Version: It Should Be Easy but... New Users’ Experiencesand Challenges with Secret Management Tools  \nLorenzo Neil  \nNorth Carolina State University Raleigh, United States of America [lcneil@ncsu.edu](lcneil@ncsu.edu)  \nDeepthi Mungara  \nPaderborn University Paderborn, Germany deepthi.mungara@uni-paderborn.de  \nLaurie Williams  \nNorth Carolina State University Raleigh, United States of America [lawilli3@ncsu.edu](lawilli3@ncsu.edu)  \narXiv :2509 .09036v1 [ cs .HC] 10 Sep 2025  \nYasemin Acar  \nPaderborn University & The George Washington University Paderborn, Germany yasemin.acar@uni-paderborn.de  \nBradley Reaves  \nNorth Carolina State University Raleigh, United States of America [bgreaves@ncsu.edu](bgreaves@ncsu.edu)  \nAbstract  \nSoftware developers face risks of leaking their software secrets, such as API keys or passwords, which can result in significant harm. Secret management tools (SMTs), such as HashiCorp Vault Secrets or Infisical, are highly recommended by industry, academia, and security guidelines to manage secrets securely. SMTs are designed to help developers secure their secrets in a central location, yet secrets leaks are still commonplace, and developers report difficulty in learning how to setup and use SMTs. While SMTs typically come with publicly available help resources (e.g., tool documentation and interfaces), it is unclear if these actually help developers learn to effectively use SMTs. Without usable help resources that onboards developers, quick adoption and effective use ofSMTs maybe unrealistic.  \nIn a qualitative two-step study, we observed 21 new users in person while they used SMTs to perform two secret management tasks: secret storage and access, then secret injection. We interviewed participants after each task to identify their challenges and experiences using SMTs, with the assistance of help resources.  \nWhile our study sample is narrow, it serves as a reasonable proxy for new developers who are likely to adopt SMTs early in their careers. We found that even in a laboratory setting where new users found tool functionality and interface flexibility helpful, they still experienced increased difficulty to effectively use SMTs to securely remediate a hard-coded secret when they felt tool documentation was insufficient. Insufficient tool documentation motivated participants to deviate from official tool documentation to access secondary sources or attempt workaround methods. Specific challenges reported by participants were tool documentation  \nA shortened version of this paper appears in the Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (ACM CCS 2025), Taipei, Taiwan. This is the full version with the interview guide, participants demographics, and codebook in the appendix. All additional study materials are available at [https://doi.org/10.5281/zenodo.17036161](https://doi.org/10.5281/zenodo.17036161).  \nPublication rights licensed to ACM. ACM acknowledges that this contribution was authored or co-authored by an employee, contractor or affiliate of the United States government. As such, the Government retains a nonexclusive, royalty-free right to publish or reproduce this article, or to allow others to do so, for Government purposes only. Request permissions from owner/author(s) .  \nCCS’25, Taipei, Taiwan  \n© 2025 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 979-8-4007-1525-9/2025/10  \n[https://doi.org/10.1145/3719027.3765065](https://doi.org/10.1145/3719027.3765065)  \ncontent quality, navigation difficulties with both tool documentation and web interfaces for finding helpful content, and supportive tool features. We explain how these challenges negatively affect participant experiences adopting SMTs, and suggest recommendations on tool documentation and interfaces for SMT developers. If developers cannot simply and quickly manage secrets securely, secret leakage will continue to be commonplace.  \nCCS Concept","cbCaif9M1pjMvfBq","https://ap.wps.com/l/cbCaif9M1pjMvfBq","pdf",981876,"English","# 1 Introduction\n## Software secrets and secret management tools\n## Documentation and onboarding challenges\n## Study motivation and scope","[{\"question\":\"Why do secret management tools remain challenging for new developers?\",\"answer\":\"Even when SMTs provide public help resources, new users still report difficulty learning how to set up and use SMTs effectively, especially under conditions where documentation is insufficient.\"},{\"question\":\"What did the qualitative study observe about new users using SMTs?\",\"answer\":\"The study observed 21 new users performing two tasks—secret storage and access, then secret injection—and interviewed them after each task to identify challenges and experiences while using help resources.\"},{\"question\":\"How can insufficient documentation affect developers’ behavior and security outcomes?\",\"answer\":\"Insufficient tool documentation can lead users to deviate from official guidance, consult secondary sources, or attempt workarounds, making it harder to securely remediate hard-coded secrets.\"}]","Extended Version - It Should Be Easy but... New Users’ Experiences and Challenges with Secret Management Tools | PDF",1791926207,6]