title: Storing encryption keys -- best practices?
body: <p>I have a web application that uses a symmetric encryption algorithm.</p>
  
  <p>How would you store the secret key and initialization vector? Storing as a literal in the code seems like a bad idea. How about app settings? What is the best practice here?</p>