40
env and secrets
Keys live in the environment, never in the repo, never in the prompt if you can help it.
What is env and secrets?
Environment variables configure a process. Secrets are the subset that grant power: API keys, tokens, private URLs. `.env` is local. The committed `.env.example` has names, not values.
Why does env and secrets matter when vibe coding?
Models love to hardcode a key “just to get it running,” or paste `.env` into the chat to debug. That is how keys leak into git, logs, and training-adjacent clipboard history.
How do you do env and secrets?
`.env` in gitignore. `.env.example` committed. Tell the agent never to print secrets. Rotate anything that appeared in a diff or a chat.
How do you ask a model for env and secrets?
Do not read, print, or commit secrets. Use env vars. If a key is missing, say which name is missing. Do not invent a placeholder key that looks real.
What goes wrong with env and secrets?
A “dummy” key that is actually a live staging key. Dummy means obviously fake, or nothing.