Every semester a student shows me a repository with an LLM API key in the first commit, and every semester someone's key is found and drained within hours. Secrets management is not advanced; it is a set of habits that take an afternoon to learn and never to unlearn. Here are the ones I insist on in every workshop.
The basic setup
- Keys live in a local environment file that is listed in the repository's ignore file before the first commit.
- An example file with the variable names and no values is committed, so teammates know what to set.
- Code reads keys from the environment and fails loudly at startup if one is missing.
- Deployment platforms hold the production keys in their secret stores; nothing is typed into a config file.
Keys never reach the browser
A front end that calls a model provider directly is publishing your key to everyone who opens developer tools. All model calls go through your own API, which holds the key and can rate-limit. This is one reason the FastAPI + Next.js architecture has two services.
Demos and screenshots
Keys appear in terminal screenshots, screen recordings and pasted logs more often than in code. Redact before you post. Use short-lived or restricted keys for demos where you can.
If a key leaks
- Revoke it first, investigate second. Minutes matter.
- Rotate every other key that was in the same file.
- Remove it from history if it was committed, and assume it was already copied.
- Check the provider's usage dashboard and set a spending limit while you are there.
Beyond keys
Database URLs, signing secrets, service account files and webhook tokens follow the same rules. So do datasets with personal data, which is where privacy by design begins. A project that handles secrets correctly is a small but real signal to anyone reviewing it that you have shipped before.
— Pranjul Rathour, GenAI Engineer from Kanpur, India. Open to GenAI roles, hackathon judging, mentorship sessions and guest talks at any campus: pranjulrathour41@gmail.com.