What you learn
- What a .env file is, why .gitignore is non-negotiable, and separate keys per environment
- What to do if you already pushed a secret: rotate it, because deleting the commit is not enough
- Convex deploy keys, and encrypting user-supplied API keys at rest instead of plain text
Summary
You now juggle keys for Clerk, Convex, soon Stripe, and probably an AI provider. Each one is a key to something valuable - your services, your money, your customers' data. Handling them well is not optional once real money and real users are involved. This lesson is the rigorous version of the secrets habit you started in Course 1: where secrets live, how to keep them out of Git forever, the emergency procedure if one escapes, how deploy keys give your hosting access without exposing your master credentials, and why any key your users give you must be encrypted, not stored as readable text.
What you will learn
You will learn what an env file is and why it exists, how to use .gitignore so a secret can never be committed, why each environment gets its own keys, the exact recovery steps if you already pushed a secret, how Convex deploy keys work and where they belong, and how to encrypt user-supplied API keys at rest so a database leak does not hand attackers your customers' credentials.
Prerequisites
The Course 1 secrets basics (keys in .env, .env in .gitignore) and a multi-service app from earlier in this course, since the risk grows with every integration you add. The Fundamentals page on what an env file is covers the absolute basics if you want them spelled out before going deeper.
A .env file stores secrets like API keys outside your code so they never get published. Learn what it is, how it works and how to keep it safe.
GitHub is a website that stores your Git projects online so you can back them up, collaborate and deploy. Learn what it is and how to use it.
A repository is your project folder tracked by Git, and version control is the safety net that records every change. Learn both in plain language.
Tokens are the chunks of text AI models read and are billed in. Learn what a token is, why it matters for cost, and how it differs from a password token.
The problem
Leaked secrets are one of the most common and most expensive beginner disasters, and they happen quietly. You paste a key into a file to test something, commit it without thinking, push to GitHub, and now that key is in your repository history forever - readable by anyone who can see the repo, and scraped within minutes by bots that scan public GitHub for exactly this. People with a leaked Stripe or cloud key have woken up to thousands of dollars of fraudulent charges. And storing your users' API keys as plain text means one database breach exposes every customer credential at once. None of this requires bad luck. It requires one careless commit. This lesson makes carelessness structurally hard.
Comments
Loading comments.
Post a comment