Environment variables and secrets: deploy without leaking keys
Separate public configuration from private credentials and keep secrets out of uploads, images, logs and AI chats.
App Cities · 2 min · Updated
An environment variable gives a setting to your app. Some settings are public, like a page title. Others are secrets, like a database password. Putting a value in a variable does not make it private. A value sent to the browser can be seen by the user.
The steps
- List required variable names and mark them public or server-only. Check your framework's rules for exposing variables to the browser.
- Reference private values from Compose without embedding them. Enter the real values through the platform's secret-entry link rather than pasting them into an AI conversation.
- Exclude .env files, credentials and private keys from archives and build contexts. Inspect error output for accidental connection strings.
- If a value leaks, rotate it at its provider. Removing it from the latest source does not invalidate the old value or erase earlier image layers.
A common question
Can my AI configure secrets?
It can identify the variable names and provide the secret-entry link. You enter the values yourself; do not share them in chat.
Ready to try your project?
Prepare your project, check the prices and choose how you want to deploy.