Six things that go wrong with API keys
None of these are exotic. They are the ordinary ways a working key ends up somewhere it should not be, and what we do about each one.
01
Your keys are sitting in plaintext on disk
A .env file is a text file. Everything on your machine that reads text files can read it.
Read the detail →02
The clipboard is the most-used secrets manager in the world
Every key gets copied at least once. The copy is what escapes, not the original.
Read the detail →03
Rotation gets deferred because nobody knows where the key went
Everyone agrees keys should be rotated. Almost nobody does it on a schedule, and the reason is logistical, not lazy.
Read the detail →04
Sharing a key is a one-way operation
You can revoke access to a document. You cannot revoke a string someone has already read.
Read the detail →05
A key committed once is committed forever
Deleting the line in a follow-up commit changes nothing. Git kept the first one.
Read the detail →06
Fetching a key costs more than the twenty seconds it takes
The interruption is not the tab switch. It is losing the thing you were holding in your head.
Read the detail →