The fastest way to a security incident is a credential committed to a repository. Once a password, API key, or token is in your version history, you have to treat it as public — even after you delete it, because the history remains and copies get cloned. Handling secrets well is not complicated, but it has to be deliberate.
Secrets never live in source control
Configuration that differs between environments — and anything sensitive — belongs outside the code. Environment variables or a dedicated secrets store keep credentials out of the repository, so the code is safe to share and a public repo is not automatically a breach. The code should describe what secret it needs, never contain the secret itself.
Limit the blast radius of any one secret
Assume every secret will leak eventually, and design so that one leaking is contained. That means each service gets its own credentials rather than a shared master key, and each credential has only the access it actually needs. When something does leak, you rotate one narrow key instead of re-securing everything at once.
- Separate secrets per environment — a leaked staging key must not open production.
- Grant the minimum access each credential needs, nothing more.
- Make rotation routine, so replacing a key is a normal task, not a crisis.
Rotation should be boring
If changing a credential is painful, it will not happen until an incident forces it — which is the worst possible time. Building rotation in early, so keys can be replaced without downtime, means that when you do need to rotate one, it is a routine change rather than an emergency.
Treat every secret as something that will one day leak. Then a leak is a chore, not a catastrophe.
Catch secrets before they are committed
People make mistakes, so the safety net matters. Automated scanning that checks for credentials before code is committed, and again in the pipeline, catches the accidental key before it reaches history. It is far cheaper to block a secret at the door than to rotate it and scrub history afterward.
The mindset
Keep secrets out of the code, give each one the least access it needs, make rotation easy, and scan for mistakes. None of it is exotic. It is the difference between a lost laptop being an inconvenience and being a breach.