Confirm the application uses Symfony secrets and has the required Sodium extension. Identify the production vault and the deployment mechanism that supplies its decryption capability.

1. Generate or maintain the vault through the documented console workflow in a controlled environment. Select the production vault explicitly using the environment mechanism required by your Symfony branch, including APP_RUNTIME_ENV where applicable.

2. Add the required secret values without writing them into a shell command that will be logged. Keep the production decryption key out of the repository and ordinary build artifacts.

3. Deliver the decryption key through protected runtime configuration or the documented protected key file. Restrict access to the account that needs it.

4. Check for real environment variables with the same names. An environment value can override the vault value, making an apparently successful secret update ineffective.

5. Test a feature that consumes the secret and document rotation and recovery. Remove temporary copies used during deployment.

Verify that the intended service can authenticate without revealing the secret. Confirm the production key is absent from public directories, repository history and downloadable deployment archives.

If decryption fails, check the selected vault, key and runtime environment. If an old value persists, inspect environment overrides before regenerating keys or replacing the encrypted vault.

• Deploying Symfony in the production environment
• Protecting production secrets in CI jobs
• Moving runtime secrets out of a public document root
• Changing a Symfony database schema safely

• Symfony secrets