Git & GitHub
/Advanced
Managing Secrets
Definition
The practice of keeping sensitive data (passwords, API keys, database URLs, AWS credentials) out of version control systems.
Explain Like I'm New
If you push an AWS API key to a public GitHub repository, bots scanning GitHub will find it within 5 seconds. Within 10 minutes, hackers will use your key to mine Bitcoin on AWS, leaving you with a $50,000 server bill. Managing secrets ensures this never happens.
Real World Example
Using a `.env` file to store your `API_KEY=12345` locally, putting `.env` in your `.gitignore`, and manually adding the API key into the Vercel or Heroku dashboard.
Common Use Cases
- •Preventing catastrophic financial and data loss
Terminal Output
bash / terminal
/*
The Golden Rules of Secret Management:
1. NEVER commit passwords, tokens, or API keys.
2. Put your `.env` file in `.gitignore` immediately.
3. If an API key is meant for the frontend (like a Google Maps public key),
it is NOT a secret. Anyone can see it in the browser network tab.
4. True secrets (Database passwords) MUST only be used on the backend server.
*/
Interview Questions
basic
- What file extension is universally used for storing local secrets in modern web dev?
intermediate
- If you accidentally push a password to a public repo, what is the FIRST thing you should do?