Level 2 · 2C Leaked keys · Lesson 1 of 2
Keys: where they live and how they leak
An API key, a token, or a database password is a key in the real sense: it opens doors. If it falls into someone else's hands, that person can act as your program: spend your money, read your data, or delete it. A secret is exactly that: data that no one outside the server should be able to see.
Keys leak through carelessness: they get written in the code and uploaded to a public repository, pasted in a chat, shown in a screenshot, in an error log, or even in a website address. There are bots that scan public code sites all day long looking for them.
Where yes and where no
Bad place: written in the code, in the page's JavaScript, in a team chat, in a "temporary" comment, or in a screenshot. Good place: in an environment variable or a server secret, in a secrets manager, or in a .env file listed in .gitignore so git never uploads it.
Going deeper
Where keys live
// BAD: the key is written in the code
const CLAVE = "sk_live_FALSA_123456";
// GOOD: the key comes from outside when the program starts
const CLAVE = process.env.CLAVE_PAGOS;- In the bad version, anyone who sees the code sees the key, and it stays saved in the history forever.
- In the good one, the code only names the variable. The real value is loaded on the server or in a secrets manager, outside the repository.
- Remember to add the local secrets file (for example .env) to .gitignore.
Review questions
You accidentally upload a key to a public repository and delete it 2 minutes later. Are you safe?
Answer: No: you have to assume it was copied and cancel it. There are bots searching for keys all day long, and on top of that the repository history keeps the old version.
Which is a good place to store a key?
Answer: In an environment variable or in a secrets manager. Outside the code and the repository, accessible only to the server.
A teammate asks you for the key in the team chat. What's the risk?
Answer: The chat keeps the history: anyone who sees it (or hacks it) has the key. Chats get saved, forwarded, and hacked. Keys are shared with tools designed for that.