Keep secrets out of your code: use .env files and a Gitleaks pre-commit hook

lilyraynyc · x · 2026-11-07

Lily Ray shares a pre-sharing security checklist for scripts at TechSEOConnect:

Put secrets in .env: API keys, emails, etc. never hardcoded; add .env/credential files to .gitignore before the first commit.
Add a secret scanner: Gitleaks or detect-secrets as a pre-commit hook to flag leaked API keys before they get pushed.
Slides also include a decision tree for "is your script ready to share": it's a team tool only if a teammate can run it on a clean machine — add README/lockfile, test against known-good data, and bring in engineering (scheduling, monitoring, peer review) if production depends on it.

More from coding & agent