In reviewJNR-007-L05

Secrets do not belong in Git

On This Lesson 4 topics

The content for this lesson is written and waiting for review. The outline below shows what it covers. It will be published once it is approved.

In this lesson

keep secrets out of the repository.

Secrets: passwords, API keys, tokens.
Git remembers everything; deleting a file later does not remove it from history.
Put secrets in environment variables or a secrets manager.
Commit .env.example with fake values; put .env in .gitignore.
If a secret leaks, rotate it (replace it) at once.

Draft outline details

text

# .env.example (committed)
SHOP_API_KEY=changeme
# .gitignore
.env

You committed a key by mistake. First step?

Show answer

Revoke and replace the key; then clean up history.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.