Secrets & Credentials

Secrets — passwords, API keys, tokens, production data — are the one place where a small slip becomes a real incident. The rules are simple, they're absolute, and a bit of prevention is highly preferable to the alternative.

The rules

  1. Never paste secrets or production data into a chat

    Not to debug, not to “ask a quick question,” not with your real code attached. Once it's in the prompt, it has left the building. Operate as if every chat transcript could be reviewed — because it could.

  2. Environment variables and secret managers, always

    Configuration that varies by environment — and everything secret — lives outside your source files. Your code reads it at runtime; the value itself is never written down in the repo.

  3. .env stays out of the repo; .env.example goes in

    Add .env to .gitignore before your first commit, and commit a .env.example with safe placeholder values so collaborators (and the AI) know what configuration exists without seeing any of it.

  4. Remember what the agent can read

    An agent with filesystem access can read your .env just like any other file. Scope its access accordingly — see Scope your agent — and never hand an agent credentials broader than the task needs.

If a secret leaks: rotate first, report second

The order matters. A leaked credential is live until it's rotated — revoke and replace it immediately, then report the incident. Nobody at ND will make you regret reporting fast.
  1. Rotate — revoke the exposed credential and issue a new one, wherever it lives.
  2. Check — did anything use the credential between exposure and rotation? Logs will tell you.
  3. Report — file the incident so the right people can assess scope. Not sure where? Start here.
  4. Fix the path — how did it get into a pastable place? Close that door (usually: it was in code or a log that should have been an environment variable).

Let the tooling catch what you miss

GitHub's secret scanning watches your repos for committed credentials and flags them — one more reason your projects belong in version control. Treat any scanner alert as real until proven otherwise, and practice the rotation script on a test credential once so the real day is muscle memory.