Is Storing API Keys in .env Enough? The Right Way to Manage Secrets

Short answer

Hardcoding API keys, database passwords, OAuth secrets, or JWT signing keys inside source code is one of the leading causes of security breaches. Automated GitHub scrapers scan public repositories continuously, compromising leaked credentials within seconds.

Securing application secrets requires strict environment variable governance and secret vaulting:

Local `.env.local` Files (Never Committed to Git)

+ `.gitignore` Enforced Exclusions + Production Secret Vaults (AWS Secrets Manager, Vercel Env Secrets) + CI/CD Secret Injection =

Zero-Leak Credential Governance

Secret Management Best Practices Matrix:

1. Core Rules of Secret Hygiene

1. **Never Commit Secrets to Git:** Verify that `.env`, `.env.local`, and `*.pem` files are explicitly listed in `.gitignore`.
2. **Use Git Pre-commit Hooks:** Install tools like `git-leaks` or `trufflehog` to scan local commits for API keys before pushing code.
3. **Rotate Leaked Credentials Immediately:** If an API key is committed accidentally, invalidate and rotate the key immediately. Simply removing the file in a new Git commit leaves the secret visible in historical Git commits.

Secret Management Checklist

• [ ] Verify `.env*` files are excluded in `.gitignore`
• [ ] Use GitHub Secrets for CI/CD build environments
• [ ] Store production keys in managed secret vaults (AWS Secrets Manager, Vercel)
• [ ] Implement pre-commit hooks to detect accidental credential commits