Stage 6 · Lesson 5 of 8
Configuration and secrets
The moment a project calls an (another service your code talks to), it gets a key, and that key must never reach . Keep settings that change between machines out of your code, such as API keys, file paths and web addresses.
Read them from environment variables instead: named values the system hands your program when it starts. During development they are often loaded from a .env file. Add .env to your .gitignore so it becomes one of the that never saves.
Then commit a .env.example with the variable names and dummy values, so others know what to set. Bots scan public repositories for leaked keys within minutes. If a key is ever committed, revoke it and create a new one, because deleting the file does not remove it from the history. When a required variable is missing, stop with a clear message.
A question to check yourself, an AI practice session and 2 cheat sheet entries come when you add the roadmap to your account. Add it
Resources for this stage
Start with
- GitHub repoFreeProject Based Learning
Community maintained · Beginner
Follow one guided build in your language, then build your own without a guide
Keep handy
Also worth your time
How to present each project: the problem, stack, challenges and results
- Build Your Own XGo deeper
When you want a harder build: a shell, a key-value store or a tiny Git, from scratch