Tech teamRunning a website or small org
Exposed secrets & API keys
Passwords and keys left, by accident, in code or in the open.
Understand it
Database passwords, API keys and tokens are sometimes committed into code, pasted into chats, or left in public storage. Automated bots hunt for these constantly and use them within minutes.
How to spot it
Secrets written into files, sitting in version-control history, or in a public repository or page.
Close the gap
- Keep secrets in environment variables or a secrets manager, never in code.
- Scan your code and its history for leaked keys, and rotate any that leak.
- Limit each key’s powers and where it may be used from.
- Never paste a live key into an email, a chat or an AI prompt.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.