Configuration without secrets in code
Separate public settings from server-only credentials.
15 minutes
Some configuration is public
A site title or public base URL can be visible in a browser. Database credentials and private API keys belong on the server in the hosting environment’s secret configuration. Anything bundled into browser code is available to the user.
Inspect the whole route
Keep secrets out of source control, logs, screenshots and agent context. If a credential is exposed, removing the text from the latest file does not invalidate the credential. Replace the exposed credential through its issuing service.