Secrets & .env hygiene

Build-along · ~10 min at your own keyboard

API keys leak three ways: pasted into chats, committed to shared folders, hardcoded in scripts. If you wire a lead-follow-up tool to a CRM or an email API, that key is a live wire. The fix is one habit: keys live in a .env file, scripts read from it, and the file never leaves the machine. Half the keys shown in YouTube videos still work months later.

Do this

0/4

Share what happened

Paste the audit result and your new NEVER rule (mask any real key values).