Lion Cipher Lab
Manage secrets in .env files safely
- Cyber / Security Engineer
- Beginner
- ~30 min
- Free · no account required
Why it matters
The first time you wire a real service into a project, you get a secret — an API key, a database password, a token — and the easiest thing in the world is to paste it straight into your code so it just works. That one shortcut is how most credential leaks start: the moment the secret is in your source, it rides along into git history, into log output, into screenshots and screen-shares, and onto any machine that clones the repo. Keeping secrets in the environment instead of the code is the everyday habit that prevents this, and it costs almost nothing once it's muscle memory. This lab builds…
What you'll learn
- keeping secrets out of source code
- reading a secret from an environment variable in Python and Node
- loading a .env file with python-dotenv or dotenv
- gitignoring .env and committing a safe .env.example
- rotating a leaked key and knowing .env's limits
Steps in this lab
- What a secret and an environment variable are
- Why hardcoding a secret is dangerous
- Set an environment variable (your OS) and read it in code
- Use a .env file so you don't retype secrets
- ALWAYS gitignore .env — before it holds anything real
- Commit a safe .env.example with no real values
- Rotate a key the moment it leaks
- The honest limit: .env is a starting point, not the finish line