DEV Community

Cover image for Secrets management for student projects: never commit an API key again
PRANJUL RATHOUR
PRANJUL RATHOUR

Posted on Originally published at pranjulrathour.scult.in

Secrets management for student projects: never commit an API key again

#security #secrets #students #bestpractices

Every semester a student shows me a repository with an LLM API key in the first commit, and every semester someone's key is found and drained within hours. Secrets management is not advanced; it is a set of habits that take an afternoon to learn and never to unlearn. Here are the ones I insist on in every workshop.

The basic setup

  1. Keys live in a local environment file that is listed in the repository's ignore file before the first commit.
  2. An example file with the variable names and no values is committed, so teammates know what to set.
  3. Code reads keys from the environment and fails loudly at startup if one is missing.
  4. Deployment platforms hold the production keys in their secret stores; nothing is typed into a config file.

Keys never reach the browser

A front end that calls a model provider directly is publishing your key to everyone who opens developer tools. All model calls go through your own API, which holds the key and can rate-limit. This is one reason the FastAPI + Next.js architecture has two services.

Demos and screenshots

Keys appear in terminal screenshots, screen recordings and pasted logs more often than in code. Redact before you post. Use short-lived or restricted keys for demos where you can.

If a key leaks

  • Revoke it first, investigate second. Minutes matter.
  • Rotate every other key that was in the same file.
  • Remove it from history if it was committed, and assume it was already copied.
  • Check the provider's usage dashboard and set a spending limit while you are there.

Beyond keys

Database URLs, signing secrets, service account files and webhook tokens follow the same rules. So do datasets with personal data, which is where privacy by design begins. A project that handles secrets correctly is a small but real signal to anyone reviewing it that you have shipped before.

About Pranjul Rathour

Pranjul Rathour in a black t-shirt holding a microphone in front of a chequered wall
On the mic

Pranjul Rathour pitching with a microphone in front of a projector slide at CSJMU, Kanpur
Pitching at CSJMU, Kanpur

Pranjul Rathour speaking from the podium at VSICS, Kanpur
At the VSICS podium, Kanpur

Pranjul Rathour holding a trophy and a certificate of merit after a win
Trophy and certificate after a win

Pranjul Rathour presenting evaluation criteria — feasibility, innovation, practicality, problem solving — on a projector screen
Walking a room through evaluation criteria

Pranjul Rathour is a GenAI engineer from Kanpur, India, and CTO at SCULT INDIA, currently shipping production RAG,
fine-tuning and agentic AI systems, mentoring 200+ students through TechVerse Enclave, and judging and speaking at
student hackathons across India. Updated 2026-09-07.

Reach out if you want to talk GenAI, book a campus session, or invite him to judge:

Pranjul Rathour · GenAI engineer, 3x hackathon winner, campus mentor. Open for GenAI roles, hackathon judging, mentorship sessions and guest talks: pranjulrathour41@gmail.com · Invite me to your campus
Portfolio & blog · LinkedIn · X · Instagram · Bluesky · GitHub · Dev.to

Top comments (0)