How do you keep API keys out of your code, your app, your logs and your git history, and what do you do the day one leaks?
- Module
- 01/05
- To read
- ~9 min
An AI-built app called a model provider directly from the browser, using an API key the coding agent had put in a NEXT_PUBLIC_ variable. What do you think happened?
In the module you make your guess first, then read what happened and why.
Server-Only Secrets
Load Secrets at Runtime, Per Environment
Scan Before and After You Push
Treat a Leak as Permanent
A list of your secrets and a plan for replacing them
A spec for your own app, as a text file you download. The module also gives you the prompt for Claude Code, Codex or Antigravity, a checklist to check what it built, and recommended skills.
- Secret managers
- A server route in front of paid APIs
- Observability without leaks