Secrets Exposure

// VULNERABLE: Secrets directly in code
const stripe = new Stripe('sk_live_abc123xyz789');

const db = new Client({
  host: 'prod-db.example.com',
  password: 'super_secret_password_123'
});

// Even "temporary" secrets often end up in production
const API_KEY = 'AIzaSyC_temp_key_for_testing'; // TODO: move to env

# Attacker searches git history for secrets
git log -p | grep -i "api_key\|password\|secret\|token"

# Or uses specialized tools
trufflehog git https://github.com/company/repo
gitleaks detect --source .

# Common patterns attackers look for:
# - AWS: AKIA[0-9A-Z]{16}
# - GitHub: ghp_[a-zA-Z0-9]{36}
# - Stripe: sk_live_[a-zA-Z0-9]{24}

// VULNERABLE: Using secret in frontend code
const response = await fetch('/api/data', {
  headers: {
    'Authorization': `Bearer ${process.env.API_SECRET}` // Gets bundled!
  }
});

// Anyone can find it in the browser:
// 1. View Page Source
// 2. DevTools > Sources > Search for 'Bearer'
// 3. Check network requests

// .env.local (NEVER commit this file)
DATABASE_URL=postgresql://user:pass@host/db
STRIPE_SECRET_KEY=sk_live_xxx

// .gitignore
.env
.env.local
.env.*.local

// Usage in server-side code only
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

// For client-side, use NEXT_PUBLIC_ prefix (public values only!)
// NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_xxx

# Install git-secrets
brew install git-secrets

# Add AWS patterns
git secrets --register-aws

# Add custom patterns
git secrets --add 'sk_live_[a-zA-Z0-9]+'
git secrets --add 'password\s*=\s*["'][^"']+["']'

# Install hook in repo
git secrets --install

# Now commits with secrets are blocked automatically

// Fetch secrets at runtime from a secure vault
import { SecretsManager } from '@aws-sdk/client-secrets-manager';

const client = new SecretsManager({ region: 'us-east-1' });

async function getSecret(secretName: string) {
  const response = await client.getSecretValue({ SecretId: secretName });
  return JSON.parse(response.SecretString!);
}

// Secrets never touch your codebase
const dbCredentials = await getSecret('prod/database');