The most valuable secret in most applications.
WHERE THEY BELONG
In environment configuration: a .env file or equivalent, outside the web root where possible, with permissions set to 600.
Never in code. Never in a repository, even a private one.
WHY NOT IN THE REPOSITORY
Repositories are cloned, forked, shared and occasionally made public by accident. Credentials committed once remain in the history even after being removed from the current version.
If credentials were ever committed, rotate them. Removing the file does not remove them from history.
CHECKING EXPOSURE
Visit the configuration file path in a browser. If you see content rather than Forbidden or Not Found, the credentials are public and must be changed immediately.
A .env file inside public_html on a misconfigured server is readable by anyone.
ROTATION
Change them when a developer leaves, when a device is lost, or when exposure is suspected.
Changing a database password means updating the application configuration at the same moment, so plan for a brief interruption.
PRIVILEGES
The application user needs privileges on its own database only. Never root.
