Keeping secrets safe

What counts as a secret

A secret is any value that lets someone act as your app. Examples: a payment gateway key, an SMS provider token, a database connection string with its password, the key used to sign JWTs, a cloud access key. Anyone who has the secret can do what your app can do.

Never in code, never in git

Git keeps every version of every file forever. If you commit a key and delete it in the next commit, it is still in the history, and anyone with the repository can find it. Bots scan public GitHub repositories for keys within minutes of a push.

# .gitignore
.env
.env.local
.env.*.local
*.pem
node_modules/

An environment variable is a named value given to your program by the system that runs it, outside the code. Your code reads process.env.NAME. On your laptop the values come from a .env file that git ignores; on the server they come from the hosting platform's settings.

// .env (never committed):  RAZORPAY_KEY_SECRET=...
const keySecret = process.env.RAZORPAY_KEY_SECRET;
if (!keySecret) {
  throw new Error('RAZORPAY_KEY_SECRET is not set');
}
// Commit a .env.example with empty values so others know which names exist

Secret managers

• Platform settings: Vercel, Render, Railway and similar hosts have a page to set environment variables per project and environment.
• Cloud secret managers: AWS Secrets Manager and Google Cloud Secret Manager store secrets encrypted, control who can read them, and keep an access log.
• HashiCorp Vault (and its open-source fork OpenBao): a self-hosted tool that can also create short-lived database passwords on demand.

Rotation means replacing a secret with a new one on a schedule (for example every 90 days) or when a team member leaves. Good secret managers can rotate some secrets automatically. Design your app so a new value can be loaded without changing code.

When a key leaks

1. Revoke or disable the leaked key at the provider first. This stops the damage right away.
2. Create a new key and put it in your environment or secret manager.
3. Deploy so the app uses the new key, and check it works.
4. Check the provider's logs and bills for anything the attacker did with the old key.
5. Remove the key from git history if needed, but remember: removing it is not enough, revoking is what protects you.
6. Write down what happened and add a check so it does not happen again.