The repo remembers everything.
That API key you pasted in
and deleted an hour later
is still in the history.
Git doesn't forget.
Neither do the bots
scanning public commits
minute by minute.
A secret in the code
is a secret you've shipped
to everyone who ever clones it.
So keep them out.
Environment variables.
A secret manager.
Anything but the source.
And when one leaks —
because one will —
rotate it, don't hide it.
The leaked key is burned
the moment it lands in a commit.
Deleting the line
doesn't un-burn it.
The safe path here is boring:
config outside the code,
rotation you can do in a minute,
scanning that yells before you push.
Boring is the point.
The exciting security stories
are the ones you never want
to be in.
– Serguey Asael Shinder
Top comments (0)