Secrets Handling

Overview

Never hardcode secrets. Never commit secrets. Never log secrets.

Secrets in code end up in version control, logs, error messages, and eventually in attackers' hands.

When to Use

• Working with API keys, tokens, passwords
• Configuring database connections
• Setting up third-party service credentials
• Asked to "just hardcode it for now"

The Iron Rule