Secrets Management (Don't Commit Your Keys)

What counts as a secret and why it leaks, how to keep API keys and passwords out of your code and out of Git, and how teams store, inject, and rotate secrets safely in production.

1. What Counts as a Secret & Why It Leaks A secret is a key to something that costs money or data; the four kinds are API keys, database passwords, tokens, and private keys, and the number-one way they leak is being hardcoded into source and committed to Git.
2. Keep Them Out of Code Move secrets out of source into environment variables or a .env file, keep that file out of Git with .gitignore, commit a .env.example with placeholders, add a pre-commit secret scanner, and rotate any secret that was ever committed because it lives in Git history forever.
3. Real Secrets Management For teams and production: a secrets manager stores keys centrally, encrypted, access-controlled, and audited; inject them at runtime instead of baking them into images; grant least privilege per key; and make rotation routine because any secret will eventually leak. Includes a leaked-secret response cheat-card.