Builder Foundations
Secrets & safety
Keep your keys out of the wrong hands
Real apps connect to paid services like AI models, databases, and payments. Each connection uses a secret. This section shows you how to keep those secrets safe.
Why secrets matter
A secret key is like the key to your house. If you leave it under the doormat in public, someone will find it. Bots scan the internet for leaked keys all day.
A leaked key can lead to:
- Surprise bills when strangers use your AI credits.
- Strangers reading or deleting your users' data.
- Your account being suspended by the provider.
The good news: a few simple habits prevent almost all of this.
What you'll learn
How to use this section
Read both pages before you build an app that uses API keys. They are short, and they will save you real money and stress. Each page follows the same format:
- What is it? — A simple analogy and explanation
- See it in action — Real files and prompts you can copy
- Try it yourself — Short practice questions
- Common mistakes — Things to watch out for
Three golden rules: never paste secret keys into prompts you share, never commit your
.env file, and never put secret keys in frontend code.Practice
Try these exercises to lock in what you just learned.
Quiz
Not startedWhich of these is NOT one of the golden rules for secrets?
What's next?
Let's start with the secret you'll use most: the API key.