--- title: Day 26/30: Your database password is not source code description: Hardcoding passwords, API keys, and tokens into application code or committing them to Git is a bad practice. AWS Secrets Manager offers a way to securely... canonical: https://daily.dev/posts/day-26-30-your-database-password-is-not-source-code-sneqyx36c twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Day 26/30: Your database password is not source code | daily.dev og:description: Hardcoding passwords, API keys, and tokens into application code or committing them to Git is a bad practice. AWS Secrets Manager offers a way to securely... og:url: https://daily.dev/posts/day-26-30-your-database-password-is-not-source-code-sneqyx36c og:image: https://api.daily.dev/og/posts/snEqyX36c.png og:image:alt: Day 26/30: Your database password is not source code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Day 26/30: Your database password is not source code **[Ezile Mdodana](https://daily.dev/sources/7vb9selrkhohgnzepmfvq)** · [@ezilemdodana](https://daily.dev/ezilemdodana) · 1 min read · 1 upvotes · 0 comments ## Summary Hardcoding passwords, API keys, and tokens into application code or committing them to Git is a bad practice. AWS Secrets Manager offers a way to securely store and manage sensitive values, with support for automated rotation for compatible services, so applications retrieve secrets at runtime instead of embedding them in code. ## Content Passwords, API keys and tokens should not be hard-coded into applications or committed to Git. AWS Secrets Manager can securely store and manage sensitive values. It can also support automated rotation for compatible services. The application retrieves the secret when required instead of carrying it around in the code. If your password is sitting in a repository called `production-final-real`, it is no longer much of a secret. Protect credentials separately from the application.  #AWSWithoutTheFluff #SecretsManager #DevSecOps ## Similar posts on daily.dev - [10 Tips for Securing Your API Keys From AI](https://daily.dev/posts/10-tips-for-securing-your-api-keys-from-ai-j649i1e7u) · Nordic APIs · 0 upvotes · 0 comments - [Preventing secret leakage in CI/CD environments](https://daily.dev/posts/preventing-secret-leakage-in-ci-cd-environments-tveiielvq) · Security Boulevard · 2 upvotes · 0 comments - [\[REDACTED\] — How to keep your mobile app’s secrets, a secret\!](https://daily.dev/posts/redacted-how-to-keep-your-mobile-app-s-secrets-a-secret--605z53tt1) · ProAndroidDev · 0 upvotes · 0 comments - [Terraform Secrets Management Best Practices: Secret Managers and Ephemeral Resources](https://daily.dev/posts/terraform-secrets-management-best-practices-secret-managers-and-ephemeral-resources-vslu5iakb) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#devsecops](https://daily.dev/tags/devsecops), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/day-26-30-your-database-password-is-not-source-code-sneqyx36c) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/day-26-30-your-database-password-is-not-source-code-sneqyx36c","headline":"Day 26/30: Your database password is not source code","text":"Hardcoding passwords, API keys, and tokens into application code or committing them to Git is a bad practice. AWS Secrets Manager offers a way to securely store and manage sensitive values, with support for automated rotation for compatible services, so applications retrieve secrets at runtime instead of embedding them in code.","url":"https://daily.dev/posts/day-26-30-your-database-password-is-not-source-code-sneqyx36c","datePublished":"2026-08-25T06:12:01.181Z","dateModified":"2026-09-13T21:26:00.717Z","author":{"@type":"Person","name":"Ezile Mdodana","url":"https://daily.dev/ezilemdodana","image":"https://media.daily.dev/image/upload/s--1OI8gwnO--/f_auto/v1771923757/avatars/avatar_7vB9SeLRKhOHGnzEpmFvQ?_a=BAMAMiiu0","description":"Software Project Lead sharing practical insights on NestJS, Angular, AWS and scalable systems.","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":8430}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/7vb9selrkhohgnzepmfvq","name":"Ezile Mdodana"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ezile Mdodana","item":"https://daily.dev/sources/7vb9selrkhohgnzepmfvq"},{"@type":"ListItem","position":3,"name":"Day 26/30: Your database password is not source code"}]} ```