Security basics

Why it matters

Your customers trust you with their data. A leak can hurt them and wreck their trust. Security isn't just for experts: a few basic rules prevent the worst mistakes.

Secret keys

The services you use give you keys: database, payments, AI. Some are secret. With them, someone can read your data or spend your money.

Simple rules:

• Never in the browser. A secret key should only be used on the server. Anything sent to the browser can be read by anyone.
• Never in a chat. Don't paste a key into an AI conversation, a forum, or a message.
• Never in your code repository. Keep keys in environment variables, and keep the file that holds them out of any public repository.
• When in doubt, rotate it. If a key might have leaked, revoke it and create a new one.