Secrets.
WHAT COUNTS
Database credentials API keys Encryption keys Mail credentials Anything environment-specific
WHERE TO KEEP THEM
In environment configuration, outside the code.
WHAT TO NEVER DO
Place them in code Commit them to version control Include them in a backup that is publicly reachable
WHERE THE CONFIGURATION FILE MUST NOT BE
Anywhere reachable by a browser.
WHAT THAT MEANS ON SHARED HOSTING
Keep application files outside the public directory, with only the entry point public.
WHAT TO CHECK
Whether your configuration file can be requested directly.
Try it.
WHAT TO DO IF A SECRET WAS EVER COMMITTED
Rotate it. Assume it is compromised.
Removing it from history does not help, because copies exist.
WHAT TO EXCLUDE FROM VERSION CONTROL
The configuration file itself.
WHAT TO COMMIT INSTEAD
An example file with placeholder values.
WHAT TO VALIDATE AT STARTUP
That required values are present.
