The single most common avoidable mistake we see is a .env file, a private key, or a service-account JSON committed to a repository. Public bots scrape new commits within seconds, and a leaked cloud key can be turned into a five-figure crypto-mining bill before you finish your coffee. Once a secret touches git history, deleting the file does not help — it lives in every clone forever.
Good news: the fix is cheap and mostly one-time. You need three habits. First, secrets never enter source control; they live in your hosting platform's environment settings or a secrets manager. Second, a scanner blocks them at commit time so a tired developer cannot leak one at 11pm. Third, you have a written rotation step so a leak is an inconvenience, not a crisis.
This post walks through setting that up for a team that uses GitHub, Vercel or a similar host, and a handful of third-party APIs. It is the setup we deploy for nearly every client before we touch anything else.
Key takeaways
- Add a thorough .gitignore for .env files and credential JSONs as the very first commit in any repo.
- Store real secrets in your platform's environment variables, not in code, and pull them locally with the CLI.
- Install a pre-commit secret scanner like gitleaks so leaks are blocked before they ever push.
- Enable GitHub push protection and secret scanning so the platform catches what the hook misses.
- Keep a one-page rotation runbook per provider so revoking a leaked key takes minutes.
Practical checklist
- Scan full git history with gitleaks and rotate anything it finds, even old keys.
- Verify every developer pulls secrets from the platform, never a shared .env in chat.
- Configure the pre-commit hook in the repo and document how new joiners install it.
- Test that a deliberately fake secret is actually blocked on commit and on push.
What to do next week
Treat secrets like cash: never leave them lying in the open, and know exactly how to cancel a card when one goes missing. Setting up scanning and a rotation runbook is an afternoon of work that pays off the first time someone fat-fingers a paste. If you want help wiring this into your repos and CI, TechTrio is glad to set it up with your team.
How we work with clients at TechTrio
Every engagement at TechTrio Automation starts with a short discovery phase: we map your current stack, traffic, conversion paths, and operational bottlenecks. From there we propose a phased roadmap — quick wins first (tracking, analytics hygiene, performance, or a focused automation), then deeper builds (product modules, integrations, or marketing systems). Our teams in Ahmedabad and Mehsana collaborate closely with stakeholders in India, the UK, USA, Canada, and the UAE, so documentation, handoffs, and support hours stay practical.
