Configuration and secrets

The moment a project calls an API (another service your code talks to), it gets a secret key, and that key must never reach GitHub. Keep settings that change between machines out of your code, such as API keys, file paths and web addresses.

Read them from environment variables instead: named values the system hands your program when it starts. During development they are often loaded from a .env file. Add .env to your .gitignore so it becomes one of the ignored files that Git never saves.

Then commit a .env.example with the variable names and dummy values, so others know what to set. Bots scan public repositories for leaked keys within minutes. If a key is ever committed, revoke it and create a new one, because deleting the file does not remove it from the history. When a required variable is missing, stop with a clear message.