secrets-rules

Secrets Handling Rules

Environment Variable Patterns

Required Environment Variables

All secrets MUST be loaded from environment variables or a secrets manager.

// CORRECT - Environment variable
const dbPassword = process.env.DB_PASSWORD;
const apiKey = process.env.API_KEY;

// WRONG - Hardcoded (NEVER do this)
const dbPassword = "my-secret-password";
const apiKey = "sk-1234567890abcdef";

Configuration Loading Pattern

// config/index.ts
export const config = {
  database: {
    host: process.env.DB_HOST || 'localhost',
    port: parseInt(process.env.DB_PORT || '5432'),
    name: process.env.DB_NAME || '{{CONFIG.project.name}}',
    // Secrets - NO defaults for production
    password: process.env.DB_PASSWORD,
    username: process.env.DB_USERNAME,
  },
  auth: {
    jwtSecret: process.env.JWT_SECRET,
    jwtExpiry: process.env.JWT_EXPIRY || '15m',
  },
  cloud: {
    region: process.env.CLOUD_REGION || 'us-east-1',
    // Never log these values
    accessKey: process.env.CLOUD_ACCESS_KEY,
    secretKey: process.env.CLOUD_SECRET_KEY,
  }
};

// Validate required secrets at startup
const requiredSecrets = ['DB_PASSWORD', 'JWT_SECRET'];
for (const secret of requiredSecrets) {
  if (!process.env[secret]) {
    throw new Error(`Missing required environment variable: ${secret}`);
  }
}

.env File Rules

• .env files MUST be in .gitignore
• Provide .env.example with placeholder values (no real secrets)
• Never commit .env files to version control
• Use different .env files per environment: .env.development, .env.staging, .env.production

Secret Rotation

• All secrets should support rotation without deployment
• Use secrets manager with automatic rotation when possible
• Log secret access (but never the secret value) for audit trails

What to Look For in Code Reviews

• grep for patterns: password, secret, key, token, credential
• Check for base64-encoded strings that might be obfuscated secrets
• Verify .env files are in .gitignore
• Check that test fixtures don't contain real credentials