--- title: Day 14/30 — Secrets Stay Out of Code | daily.dev description: A concise reminder that .env files are configuration, not secret management. Production secrets should be stored outside the repository, restricted by... canonical: https://daily.dev/posts/day-14-30-secrets-stay-out-of-code-npt9efggn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Day 14/30 — Secrets Stay Out of Code | daily.dev og:description: A concise reminder that .env files are configuration, not secret management. Production secrets should be stored outside the repository, restricted by... og:url: https://daily.dev/posts/day-14-30-secrets-stay-out-of-code-npt9efggn og:image: https://api.daily.dev/og/posts/nPt9EFGgn.png og:image:alt: Day 14/30 — Secrets Stay Out of Code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Day 14/30 — Secrets Stay Out of Code **[Nestjs Developers](https://daily.dev/sources/nestjsdevs)** · [@ezilemdodana](https://daily.dev/ezilemdodana) · 1 min read · 25 upvotes · 5 comments ## Summary A concise reminder that .env files are configuration, not secret management. Production secrets should be stored outside the repository, restricted by environment, and rotated when exposure is suspected. NestJS applications should validate configuration at startup, fail fast on missing values, scrub secrets from logs, use managed secret storage, and keep credentials out of source code and Docker images. ## Content An `.env` file is configuration. It is not automatically secret management. Production secrets should be stored outside the repository, restricted by environment and rotated when exposure is suspected. Your NestJS application should: - Validate configuration during startup - Fail fast when required values are missing - Remove secrets from logs - Use managed secret storage where possible - Keep credentials out of source and Docker images The most dangerous secret is often the one printed in an error log. How do you manage production secrets? #NestJS #Security #DevOps ## Community discussion Top comments from developers on daily.dev. **@adarshks** · 2 upvotes > Most of the times the security concerns are neglected by developers. I saw so many secrets in many systems in the logs. **@navyaak** · 1 upvotes > The funny part is that we put every secret in the `.env` file and then commit it to the repository as well. > The dangerous part is that even if you delete the file in a later commit, the secrets still remain in the Git history. ## Similar posts on daily.dev - [Stop Putting Secrets in .env Files](https://daily.dev/posts/stop-putting-secrets-in-env-files-yml3clr0r) · Lobsters · 2 upvotes · 0 comments - [Where .env Went Wrong](https://daily.dev/posts/where-env-went-wrong-xvemkprut) · Hacker News · 0 upvotes · 0 comments - [Preventing secret leakage in CI/CD environments](https://daily.dev/posts/preventing-secret-leakage-in-ci-cd-environments-tveiielvq) · Security Boulevard · 2 upvotes · 0 comments - [Local Guardrails for Secrets Security in the Age of AI Coding Assistants](https://daily.dev/posts/local-guardrails-for-secrets-security-in-the-age-of-ai-coding-assistants-xgxgddqse) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#nestjs](https://daily.dev/tags/nestjs), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/day-14-30-secrets-stay-out-of-code-npt9efggn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/day-14-30-secrets-stay-out-of-code-npt9efggn","headline":"Day 14/30 — Secrets Stay Out of Code","text":"A concise reminder that .env files are configuration, not secret management. Production secrets should be stored outside the repository, restricted by environment, and rotated when exposure is suspected. NestJS applications should validate configuration at startup, fail fast on missing values, scrub secrets from logs, use managed secret storage, and keep credentials out of source code and Docker images.","url":"https://daily.dev/posts/day-14-30-secrets-stay-out-of-code-npt9efggn","datePublished":"2026-08-12T07:01:02.510Z","dateModified":"2026-09-13T21:17:30.009Z","author":{"@type":"Person","name":"Ezile Mdodana","url":"https://daily.dev/ezilemdodana","image":"https://media.daily.dev/image/upload/s--1OI8gwnO--/f_auto/v1771923757/avatars/avatar_7vB9SeLRKhOHGnzEpmFvQ?_a=BAMAMiiu0","description":"Software Project Lead sharing practical insights on NestJS, Angular, AWS and scalable systems.","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":8430}},"image":"https://media.daily.dev/image/upload/s--45l9vvmL--/f_auto/v1786518063/posts/nPt9EFGgn?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":25},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":5}],"comment":[{"@type":"Comment","text":"Most of the times the security concerns are neglected by developers. I saw so many secrets in many systems in the logs.","datePublished":"2026-08-13T04:06:35.007Z","url":"https://daily.dev/posts/nPt9EFGgn#c-N8EdP0Jbp","author":{"@type":"Person","name":"Adarsh KS","url":"https://daily.dev/adarshks","image":"https://media.daily.dev/image/upload/s--AOhSU9kx--/f_auto/v1785742065/avatars/avatar_gdco5dGLTOCNm55DPuark?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"The funny part is that we put every secret in the .env file and then commit it to the repository as well.\nThe dangerous part is that even if you delete the file in a later commit, the secrets still remain in the Git history.","datePublished":"2026-08-13T17:21:35.426Z","url":"https://daily.dev/posts/nPt9EFGgn#c-ePw0iPbfk","author":{"@type":"Person","name":"navya","url":"https://daily.dev/navyaak","image":"https://media.daily.dev/image/upload/s--vM6dTj_h--/f_auto/v1788852968/avatars/avatar_DLRmpRw88MjNBUKqs8T0W?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/nestjsdevs","name":"Nestjs Developers"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Nestjs Developers","item":"https://daily.dev/squads/nestjsdevs"},{"@type":"ListItem","position":3,"name":"Day 14/30 — Secrets Stay Out of Code"}]} ```