GitHub scanners find thousands of committed API keys daily; bots exploit them within minutes. The discipline is simple and non-negotiable.
The pattern
# .env (NEVER committed) DATABASE_URL=mongodb+srv://user:pass@cluster... JWT_SECRET=long-random-string OPENWEATHER_KEY=abc123 # .env.example (committed — the documentation) DATABASE_URL= JWT_SECRET= OPENWEATHER_KEY=
# .gitignore — line one, before first commit .env node_modules/
// Node 20+: built in, no dotenv package needed node --env-file=.env index.js process.env.JWT_SECRET
The frontend truth
There are NO secrets in frontend code. VITE_-prefixed vars are bundled into public JS — anyone can read them. Frontend env vars are for configuration (API URLs); real secrets live server-side, and the frontend asks YOUR backend, which holds the key.
Leaked a key anyway?
- Rotate it immediately (new key, revoke old) — this is the fix
- Removing the commit is NOT enough — history, forks and scrapers already have it
- Then scrub history (git filter-repo) to stop future finds
In production (Render/Vercel), set the same variables in the dashboard — the .env file never leaves your laptop.
← All Articles