Keeping settings out of code.
WHAT COUNTS AS CONFIGURATION
Database details API keys File paths Behaviour that differs between environments
WHY SEPARATE IT
So the same code runs in development and production So secrets never reach version control
WHERE TO PUT IT
Environment variables A configuration file excluded from version control
WHAT TO PROVIDE
An example configuration file, with placeholder values, which is committed.
WHY
So anyone setting the project up knows what is required.
WHAT NEVER TO COMMIT
Passwords API keys Database credentials Anything from a production environment
WHAT TO DO IF SOMETHING WAS COMMITTED
Assume it is compromised. Rotate it.
Removing it from history is not sufficient, because copies exist.
WHAT TO VALIDATE AT STARTUP
That required configuration is present.
Failing immediately with a clear message beats failing later, obscurely.
WHAT TO DOCUMENT
Every setting and what it does.
