Knowledge Maxxing← Back to topic library
Dev MaxxingAdvancedApplication Security75 sec
Secret
A secret is sensitive configuration data, like an API key or database password, that must be kept out of source code and version control to avoid exposure.
Prerequisite: Password hashing
What matters
Because committed code is often shared, copied, or made public, a secret hard-coded into source code can end up exposed to far more people than ever intended.
Example
A database password should be loaded from an environment variable at runtime, rather than written directly into a source file that gets committed to a repository.
Common misconception
Deleting a secret from the latest version of a file does not remove it if it was already committed; it typically still exists in that repository's earlier history.
Recall question
Why is hard-coding a secret directly into a committed source file risky?
Keywords and related concepts
secretcredentialsenvironment variablepassword hashing