vibestacklab, AI coding tools, sourced in publicvibestacklabAI coding tools, sourced in public
Follow @devdudejeremy on X
Menu

Guide

beginner

Keeping API keys safe

Updated 2026-10-15. Sourced from vendor docs · verified 15 Oct 2026 · hands-on test pending wherever a sentence depends on a vendor page.

An API key is a password for a service. It belongs in an environment variable on the machine or host, not in chat and not in git.

Answer

Treat every secret like a password. Put it in an env var, keep .env out of git, and use the public key only where the vendor says the browser is allowed to see it. If a key hits a public GitHub repo, GitHub's secret scanning can flag known credential types, and you should rotate the key anyway.

Beginner path

The rule

If a string unlocks a paid account, it does not go in the chat, the screenshot, or the repository.

Say this instead:

Ask for a key without pasting it
Read the payment key from an environment variable named STRIPE_SECRET_KEY.
Do not write the key into any file.
If the variable is missing, show a clear error. Do not invent a key.

Create .env on your computer and add .env to .gitignore before the first commit. On Vercel, the same names go in the project's environment variable settings. Vercel documents that screen in its environment variables docs.

  • The prompt names the variable and not the secret.
  • .env is in .gitignore.
  • The host has the variable set for the deployed app.
  • I know how to revoke the key in the vendor's dashboard.

Advanced path

Scanners and rotation

GitHub secret scanning checks git history on public repositories for known credential patterns, and it also scans issues, pull requests, discussions, wikis, and gists. Partner secrets can be reported to the provider. That is a safety net, not a design.

For a private organization repo, the docs require GitHub Secret Protection on Team or Enterprise Cloud. If you do not have it, assume nobody is watching.

When a key leaks, rotate first. Rewriting git history is optional and easy to get wrong. MCP servers that can read your files make this sharper: a server with shell access can see .env even when the chat never did. Only enable a server whose README you have read.

Next step

Questions

What is an environment variable?

A value the program reads from the place it is running, instead of from the source code. Locally that is often a .env file. On a host it is a setting in the dashboard.

Does GitHub always scan private repos for free?

GitHub's docs say secret scanning runs automatically for free on public repositories. Organization-owned private and internal repositories need GitHub Secret Protection on Team or Enterprise Cloud. Do not rely on a scanner you have not turned on.

Sources