What is a secret?
In software, a secret is any value that grants access and must therefore stay private: API keys, passwords, database credentials, encryption keys, and access tokens. An app needs its secrets to function, and anyone else holding them can act as the app, spend on its accounts, or read its data.
Secrets are the crown jewels of a vibe-coded project precisely because everything else is disposable. Code can be regenerated in minutes; a leaked credential creates real bills and real exposure.
Where do secrets belong?
In environment variables or a secret manager, never in the code itself. Hosting platforms and app builders provide a settings area for environment variables exactly so that code can reference a secret by name without containing its value. The code says which secret it needs; the environment supplies it.
The don't-list is short and absolute: not hardcoded in source files, not in frontend code that ships to the browser, not committed to a repository, and not pasted into shared documents. AI tools sometimes hardcode keys when asked to wire an integration quickly, which is why builders check.
What happens when a secret leaks?
Whoever finds it inherits the access. Leaked AI API keys get used for free model calls within hours, billed to the owner; leaked database credentials expose every record. Automated scanners crawl public repositories for key patterns continuously, so a secret in a public repo should be treated as found.
Recovery order matters: revoke and replace the credential first, at the service that issued it, then clean up the code. Deleting the key from a file does nothing for the copies already out there.
