DEV Community

Hive80-lab
Hive80-lab

Posted on

The 10-Minute Secrets Audit That Stops One Leaked .env File From Ending Your Product

#webdev #productivity #devops #security

A freelance developer I know shipped a landing page, pushed to GitHub, and went to bed. Their .env file went with it. By morning a bot had drained their demo database and someone was emailing "customers" from their domain. The product wasn't hacked — the secrets were. Here is the 10-minute audit that prevents that week.

The audit: 4 checks, 10 minutes

  1. Find every place secrets actually live. Run grep -r "API_KEY\|SECRET\|PASSWORD" --include="*.py" --include="*.js" --include="*.yml" . in your repo. Anything hardcoded outside a config file is a finding. Then find . -name ".env*" -o -name "*.pem" -o -name "credentials*" — every hit must be in .gitignore, verified with git check-ignore.

  2. Check git history, not just git status. git log --all --full-history -- ".env" — if that file was EVER committed, deleting it today means nothing. Old commits still hand it out. Rotate every secret that ever touched history; rotation is the only real fix.

  3. Verify scope. For each key ask: what can this key actually do? A Stripe key that can issue refunds does not belong in a frontend. A full-access cloud token does not belong in CI. Downgrade every key to the narrowest scope that still works — 5 minutes per key, and each one is a blast-radius cut.

  4. Test the leak path. Push to a fresh clone, then search the clone for one secret value: git grep "your-secret-value". If it appears, your ignore file is lying to you. This is the only check that proves the other three.

The rotation drill nobody does until it's too late

Pick your most important key. Rotate it right now, during the audit: create the new one, swap it in, delete the old. Time it — that's your real emergency rotation time, and knowing it matters the day a key IS leaked and every minute is exposure. Most solo devs discover their rotation takes 3 hours of fumbling. Do it once while calm and it becomes a 10-minute drill.

Make it boring

Secrets audits fail because they're ad-hoc heroics. Put the 4 checks on a one-page checklist with owner and date, run it monthly, and you never think about it again — the same boring-cadence rule as backups and restores.

This audit is one page in my Automation Starter Pack — the full pack adds the incident timeline, the offboarding checklist (the #1 source of zombie keys), and the post-incident report format: Automation Starter Pack · First 30 Minutes: Emergency Response Kit.

Full store of small-ops playbooks: https://hive80lab.gumroad.com

Top comments (0)