Keep Secrets Out of Code and Prompts
Kitty is about to send monthly reminder emails through an email service, which gives you an API key: a long string that lets any program holding it send email as you. The assistant's first draft pastes that key straight into reminders.py, and it works first time. It also means that anyone who ever sees that file, its history or your prompt can send email in your name.
The rule
Secrets live in the environment, never in code, commits or prompts.
A secret is anything that grants access: API keys, database passwords, the key that signs login cookies. There are three common ways they leak when vibe coding:
- Typed into code. Once a secret is committed, it stays in the repository's history even after you delete the line. If the repository is ever shared or made public, assume the secret is exposed.
- Pasted into prompts. Prompts may be stored or logged by services you do not control. Share the error message, not the key.
- Printed or displayed. Debug output, logs and detailed error pages can show configuration values to people who should never see them.
The safe pattern reads secrets from environment variables, values set outside the code when the program starts:
import os
EMAIL_API_KEY = os.environ["KITTY_EMAIL_API_KEY"]
SECRET_KEY = os.environ["KITTY_SECRET_KEY"]On your own machine, the values often live in a .env file that is loaded at startup, and that file is listed in .gitignore so git never records it:
# .gitignore
.envIf a secret does leak, deleting it from the code is not enough. Revoke it at the service that issued it and create a new one. That is the only step that makes the leaked copy useless.
The shortcut
Before every commit, search the diff for secrets: words like key, secret, password and token, and long random-looking strings. Before every prompt, ask: would I be fine if a stranger read this?
Spot
The diff contains
EMAIL_API_KEY = "a8f3..."with the real key in quotes.
The trap is thinking "I deleted it in the next commit." History remembers, and so does anyone who copied the repository in between.
Drills
Answer fast — trust the rule.
Where should Kitty's email API key live?
You committed a key, then deleted it in the next commit. Is it safe now?
The assistant needs to debug a failed email call. What should you paste?
Why is .env listed in .gitignore?
Remember
- Rule: secrets live in the environment, never in code, commits or prompts.
- Shortcut: search every diff for key-like words and strings, and ask "fine if a stranger read this?" before every prompt.
- Trap: believing a deleted line is a deleted secret. If it escaped, revoke it.