School · Secrets and API keys

Secrets and API keys

Keep keys out of git, out of the browser, and rotate them when they leak.

1. Keep .env files out of git
2. No secret keys in the browser bundle
3. Rotate a leaked key the same day
4. Turn on secret scanning before the next push

All school modules