Secrets and environment variables: how not to leak your keys

# Copy to .env and fill in. Never commit .env — only this template.

# --- Config (not secret: may differ between dev, staging and production) ---
PORT=3000
APP_URL=http://localhost:3000
LOG_LEVEL=info

# --- Secrets (get them from the team's password manager, never from chat) ---
# PostgreSQL connection string with login and password
DATABASE_URL=postgres://app:CHANGE_ME@localhost:5432/leads
# Payments: test key from the provider dashboard, test mode only
PAYMENTS_SECRET_KEY=sk_test_YOUR_KEY
# Anti-spam API key
SPAM_API_KEY=YOUR_API_KEY

node_modules/
# Local secrets: every .env file except the template
.env
.env.*
!.env.example

echo ".env" >> .gitignore
git rm --cached .env
git commit -m "Stop tracking .env"

{
  "scripts": {
    "dev": "node --env-file=.env --watch src/main.ts",
    "start": "node src/main.ts"
  }
}

// Reads configuration once at startup and fails fast if something is missing.
const required = ['DATABASE_URL', 'PAYMENTS_SECRET_KEY', 'SPAM_API_KEY'] as const;

const missing = required.filter((name) => !process.env[name]);
if (missing.length > 0) {
  // Name the variables, never print their values
  console.error(`Missing environment variables: ${missing.join(', ')}`);
  process.exit(1);
}

const paymentsKey = process.env.PAYMENTS_SECRET_KEY!;
if (process.env.NODE_ENV === 'production' && paymentsKey.startsWith('sk_test_')) {
  console.error('PAYMENTS_SECRET_KEY: a test key in production');
  process.exit(1);
}

export const config = {
  port: Number(process.env.PORT ?? 3000),
  appUrl: process.env.APP_URL ?? 'http://localhost:3000',
  logLevel: process.env.LOG_LEVEL ?? 'info',
  databaseUrl: process.env.DATABASE_URL!,
  paymentsSecretKey: paymentsKey,
  spamApiKey: process.env.SPAM_API_KEY!,
};

// For logs: show that a secret is set, but not the secret itself
export const mask = (value: string) => `${value.slice(0, 8)}… (${value.length} chars)`;

import { config, mask } from './config.ts';

console.log(`port=${config.port} log=${config.logLevel}`);
console.log(`payments key: ${mask(config.paymentsSecretKey)}`);

$ node --env-file=.env src/main.ts
port=3000 log=debug
payments key: sk_test_… (28 chars)
$ PORT=4000 node --env-file=.env src/main.ts
port=4000 log=debug
payments key: sk_test_… (28 chars)
$ node src/main.ts; echo "exit code: $?"
Missing environment variables: DATABASE_URL, PAYMENTS_SECRET_KEY, SPAM_API_KEY
exit code: 1
$ NODE_ENV=production node --env-file=.env src/main.ts; echo "exit code: $?"
PAYMENTS_SECRET_KEY: a test key in production
exit code: 1

# Public: goes into the browser bundle at build time
NEXT_PUBLIC_MAPS_KEY=pk_test_FAKE_maps_browser_key
# Secret: server only
PAYMENTS_SECRET_KEY=sk_test_FAKE7d2c9e41b8a05f36

'use client';

export function MapWidget() {
  // NEXT_PUBLIC_: the value is inlined into the browser bundle
  const mapsKey = process.env.NEXT_PUBLIC_MAPS_KEY;
  // No prefix: on the client Next.js leaves this empty
  const secret = process.env.PAYMENTS_SECRET_KEY;
  return (
    <p>
      maps key: {mapsKey}, payments key on the client: {secret || 'not available'}
    </p>
  );
}

import 'server-only';

// Any import of this module from a Client Component fails the build
export async function createPayment(amount: number) {
  const key = process.env.PAYMENTS_SECRET_KEY;
  if (!key) throw new Error('PAYMENTS_SECRET_KEY is not set');
  // A real app would call the payment provider's API with this key
  return { amount, keyIsSet: key.length > 0 };
}

$ npx next build
▲ Next.js 16.4.0 (Turbopack)
- Environments: .env.local
…
$ grep -rl "pk_test_FAKE_maps_browser_key" .next/static
.next/static/chunks/3r_kr6wnxt_zd.js
$ grep -rl "sk_test_FAKE7d2c9e41b8a05f36" .next/static || echo "not in the client bundle"
not in the client bundle

$ npx next build
> Build error occurred
Error: Turbopack build failed with 2 errors:
./lib/payments.ts:1:1
Error: You're importing a module that depends on "server-only". This API is only available in Server Components in the App Router, but you are using it in the Pages Router.
    Learn more: https://nextjs.org/docs/app/building-your-application/rendering/server-components
> 1 | import 'server-only';
    | ^^^^^^^^^^^^^^^^^^^^^
Ecmascript file had an error
Import traces:
  Server Component:
    ./lib/payments.ts
    ./app/page.tsx
  Client Component Browser:
    ./lib/payments.ts [Client Component Browser]
    ./app/map-widget.tsx [Client Component Browser]
…

name: Migrate

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  migrate:
    runs-on: ubuntu-24.04
    environment: production # the job gets production secrets only
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
      - run: npm ci
      - name: Run migrations
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }} # an env var, not a command-line argument
        run: npm run migrate

$ docker build -q -t env-leak --build-arg PAYMENTS_SECRET_KEY=sk_test_FAKE7d2c9e41b8a05f36 .
sha256:1eda9198ee8f…
$ docker history --no-trunc env-leak | grep -o "PAYMENTS_SECRET_KEY=[a-zA-Z0-9_]*" | head -1
PAYMENTS_SECRET_KEY=sk_test_FAKE7d2c9e41b8a05f36
$ docker inspect env-leak --format "{{json .Config.Env}}"
["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SPAM_API_KEY=FAKE_spam_key_baked_into_image"]

docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.30.1 git -v --redact --no-banner /repo

$ docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.30.1 git -v --redact --no-banner /repo
Finding:     REDACTED'
Secret:      REDACTED
RuleID:      stripe-access-token
Entropy:     4.521641
File:        src/payments.ts
Line:        1
Commit:      d7e5da9132cc2f72e810470d91a16146c0f49549
Author:      Dev
Email:       dev@example.com
Date:        2026-10-12T01:52:59Z
Fingerprint: d7e5da9132cc2f72e810470d91a16146c0f49549:src/payments.ts:stripe-access-token:1

1:53AM INF 2 commits scanned.
1:53AM INF scanned ~218 bytes (218 bytes) in 172ms
1:53AM WRN leaks found: 1
$ echo $?
1

name: Secret scan

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  gitleaks:
    name: gitleaks
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # the whole history, not just the last commit
          persist-credentials: false
      - name: Scan git history
        run: >-
          docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.30.1
          git --redact --no-banner /repo

git clone https://github.com/YOUR-USERNAME/YOUR-REPOSITORY
cd YOUR-REPOSITORY
echo 'sk_test_FAKE7d2c9e41b8a05f36' > ../leaked.txt
git filter-repo --sensitive-data-removal --replace-text ../leaked.txt
git push --force --mirror origin

$ git filter-repo --sensitive-data-removal --replace-text ../leaked.txt
NOTICE: Fetching all refs from origin to make sure we rewrite
        all history that may reference the sensitive data, via
      git fetch -q --prune --update-head-ok --refmap "" origin +refs/*:refs/*
…
You rewrote 2 (of 2) commits.

NOTE: First Changed Commit(s) is/are:
  d7e5da9132cc2f72e810470d91a16146c0f49549
…
$ git log --oneline
d931c47 Move payments key to env
dd4cd57 Add payments client
$ git show HEAD~1:src/payments.ts | head -1
const PAYMENTS_SECRET_KEY = '***REMOVED***';
$ docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.30.1 git -v --redact --no-banner /repo
1:53AM INF 2 commits scanned.
1:53AM INF no leaks found