Lion Cipher Lab
Handle API keys and secrets without leaking them
- AI Security
- Beginner
- ~30 min
- Free · no account required
Why it matters
The moment you start building with AI or cloud services, you get an API key — a secret string that authenticates as you and bills to your account. Leaked keys are one of the most common and expensive mistakes in modern development: a key committed to a public repo can be found and abused within minutes, running up huge bills on your AI or cloud account or reaching your data. The habits that prevent this are simple and universal — keep secrets out of code, out of version control, scoped to the minimum, and rotatable — but they have to be habits, because a single slip publishes the key forever.…
What you'll learn
- why API keys are high-value credentials
- keeping secrets out of code with environment variables
- using a .env file and .gitignore correctly
- rotating a key and scoping it to least privilege
- graduating to a secrets manager
Steps in this lab
- What an API key really is
- Keep secrets in the environment, not in code
- Use a .env file — and gitignore it
- Scope keys to least privilege, and use separate keys
- Know how to rotate — and that deleting a commit isn't enough
- Graduate to a secrets manager for anything real
- Why this boring habit protects real money