API keys
2 articles with this tag
Stop secrets before they commit with gitleaks: catch API-key leaks before the push
Secrets can't be 'deleted after they leak.' Once committed, a secret stays in Git history, and once pushed it must be treated as leaked — the key needs revoking/rotating. gitleaks is a free tool that scans the whole repo and commit history with regex/entropy to find API keys, private keys, and tokens. The core of the defense is two gates: a pre-commit hook that stops it locally before the push, and CI/cron that catches what slips through. .gitignore only prevents new tracking — it can't detect, so you still need a scanner.
Security basics: what's actually dangerous about .env and API keys
Start here. Understand what happens when .env and API keys leak (spare key → impersonation → fraudulent billing), then adopt four habits today: don't expose them, don't commit them, rotate everything if leaked, and self-check.