Environment-variable secret handling
Separate public configuration from server secrets so the site can operate without exposing account credentials.
Keep the secret behind the server
OPEN FULL SIZE ↗- Browser
- Public configuration
- Server
- Secret-dependent actions
- Leak response
- Rotate the credential
TECHNICAL NOTES///
Separate public configuration from server secrets so the site can operate without exposing account credentials.
GOALRun the first test described in this guide and record the result for environment-variable secret handling.
STEPS
- List each variable, what uses it and whether it is public or secret. Store only names and harmless examples in an example environment file.
- Put secrets in the host’s secret/configuration facility and local ignored environment files. Apply least-privilege credentials.
- Check the framework’s public-variable prefix rules before building; some prefixes deliberately embed values in browser bundles.
- Test missing-variable failures and inspect logs for accidental exposure. Rotate any credential that has entered source history or a public artifact.
TROUBLESHOOTING
- Removing a secret from the latest file does not revoke leaked access. Do not paste real keys into this website article, URLs, browser storage or screenshots.
THINGS TO WATCH FOR
Removing a secret from the latest file does not revoke leaked access. Do not paste real keys into this website article, URLs, browser storage or screenshots.
RESULTThe browser should receive only public configuration; secret-dependent actions should run server-side.
DEVELOPMENT HISTORY///
Imported as an independent manifest record; public copy keeps uncertainty visible.
SPECIFICATION///
RELEASED MATERIAL///
The browser should receive only public configuration; secret-dependent actions should run server-side.
The record keeps what is known at this revision. Unfinished tests stay unfinished here.