<commit_before>== FAQ

This document provides a quick reference for frequently questioned concepts and features in Credentials.

=== Where do credentials get stored?

By default, Jenkins uses an internal credentials store where credentials secret data are encrypted at rest in the Jenkins controller file system.
This security model does not prevent anyone with read access to the controller file system from reading and decrypting those secrets.
For more sensitive secrets, it is highly recommended to install and use an external credentials provider plugin which delegates the secure storage of secrets to a proper key management system.
Various cloud providers (including https://plugins.jenkins.io/aws-secrets-manager-credentials-provider/[AWS], https://plugins.jenkins.io/azure-keyvault/[Azure], and https://plugins.jenkins.io/gcp-secrets-manager-credentials-provider/[GCP]) have secrets management and HSMs available for this purpose, and open source software such as https://plugins.jenkins.io/kubernetes-credentials-provider/[Kubernetes], https://plugins.jenkins.io/hashicorp-vault-plugin/[Vault], or https://plugins.jenkins.io/conjur-credentials/[Conjur] provide more generic secrets management for multiple platforms.

=== How should I organize my credentials?
<commit_msg>Enumerate plugins in list<commit_after>== FAQ

This document provides a quick reference for frequently questioned concepts and features in Credentials.

=== Where do credentials get stored?

By default, Jenkins uses an internal credentials store where credentials secret data are encrypted at rest in the Jenkins controller file system.
This security model does not prevent anyone with read access to the controller file system from reading and decrypting those secrets.
For more sensitive secrets, it is highly recommended to install and use an external credentials provider plugin which delegates the secure storage of secrets to a proper key management system.
There are several solutions available for storing and securing secrets, many of which integrate with hardware security modules (HSMs) for additional physical security of secrets.
Examples of common external credentials stores for cloud providers or self-hosted environments include:

. https://plugins.jenkins.io/aws-secrets-manager-credentials-provider/[AWS]
. https://plugins.jenkins.io/azure-keyvault/[Azure]
. https://plugins.jenkins.io/conjur-credentials/[Conjur]
. https://plugins.jenkins.io/gcp-secrets-manager-credentials-provider/[GCP]
. https://plugins.jenkins.io/kubernetes-credentials-provider/[Kubernetes]
. https://plugins.jenkins.io/hashicorp-vault-plugin/[Vault]

A full listing (including some developer-level details) of https://www.jenkins.io/doc/developer/extensions/credentials/[plugins that provide credentials extensions] is available in the developer documentation.

=== How should I organize my credentials?

{'fraction_non_alphanumeric': 0.07291666666666667, 'fraction_numerical': 0.0, 'mean_word_length': 5.402222222222222, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 13, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3569711', 'n_tokens_mistral': 699, 'n_tokens_neox': 659, 'n_words': 301}