Hardcoded secrets

Deep in the mystical land of Codeshire, a slightly scatterbrained wizard named Archibald the Absentminded has invented a magical weather bot called Stormy. Stormy connects to weatherwand.xyz, a powerful enchanted weather forecasting service.

WeatherWand offers two types of API services:

• Free tier: limited forecasts, simple sun/rain predictions, and a cap of 100 calls per day.
• Premium tier: advanced features like hour-by-hour forecasts, storm tracking, and real-time dragon flight advisories, with no usage limits—but at a hefty price per request.

Archibald, eager to impress his fellow villagers, signed up for a premium WeatherWand API key to make sure Stormy always gave the most accurate predictions. But in his haste to share his project with the world, he made a critical mistake:

Almost immediately, someone discovers Stormy's repository and notices the hardcoded API_KEY. How fast? Remarkably fast! There are a lot of bad actors who are actively scanning for secrets. And now that one of these bad actors have this applications key, they can start making thousands of premium API requests. And these are all billed to Archibald's account!

To protect Stormy, Archibalid updates his code to load secrets securely from the environment:

Archibalid now stores the API key in a .env file for local development:

When Archibald is ready for production, if they are using a cloud provider, then providers like AWS, GCP, Azure encourage using their Secret Managers:

• AWS Secrets Manager / AWS Parameter Store
• Google Secret Manager
• Azure Key Vault

Services like Heroku, Vercel, Netlify, Render, AWS Elastic Beanstalk, etc. don't use your .env file directly. Instead, you manually set environment variables in the platform's dashboard or CLI.

They store them securely and inject them into your running process as actual environment variables. Your app can access them as if they came from a .env file.

If you've accidentally committed a secret, even once, you must assume it's compromised. Delete the exposed credential from the codebase, but don't stop there. Rotate the secret (such as generating a new API key or password) and update any dependent services. Secrets scanning tools like GitGuardian, TruffleHog, and Snyk Code can help find other exposures. Also consider auditing access logs to check for abuse