- Sensitive data (e.g., API keys, database connection strings) must never be committed to the repository.
- Use
secrets.jsonto store secrets in local, staging, and production environments. - Add sensitive files (e.g.,
.env,config.yml,secrets.json) to.gitignoreto prevent them from being tracked. - Enable secret scanning and monitoring tools (e.g., GitHub Secret Scanning, GitGuardian).