Secrets management — where to actually store your API keys
Not in .env files. Not in localStorage. Here is the 2026 guide to storing and accessing secrets in a small-team Node.js / Python app.
Where you store secrets determines how badly a leak hurts. This guide covers the four tiers of secret storage, with recommendations by team size.
What it is
A secret is any credential whose compromise would lead to abuse — API keys, database passwords, signing secrets, private keys. 'Secrets management' is where you store them, how you access them, and who can rotate them.
Vulnerable example
// Tier 0: in code
const stripeKey = "sk_live_...";
// Tier 1: .env committed
// .env
STRIPE_SECRET_KEY=sk_live_...
// These both leak the moment git history goes public.Fixed example
// Tier 2: environment variables injected at runtime (Vercel, Fly, Railway)
const stripeKey = process.env.STRIPE_SECRET_KEY!;
// .env is in .gitignore; .env.local is in .gitignore; only .env.example is committed.
// Tier 3: secrets manager (1Password, Doppler, Vault)
import { getSecret } from "./secrets";
const stripeKey = await getSecret("STRIPE_SECRET_KEY");
// Tier 4: short-lived credentials via OIDC / Workload Identity
// No secrets checked in anywhere; your app assumes an identity and gets tokens.How Securie catches it
Securie's secret scanner detects keys at Tier 0 and Tier 1 immediately. It also validates that your production deploy actually uses Tier 2+ by checking the live bundle for any pattern that matches a known secret shape.
Checklist
- No secrets in source (Tier 0) — ever
- No secrets in committed .env files (Tier 1)
- Production uses injected env vars (Tier 2) at minimum
- Small teams on Tier 3 (Doppler / 1Password / Vercel env)
- Regulated / larger teams on Tier 4 (Vault + OIDC + short-lived credentials)
- Rotation automated (not 'we will rotate if someone leaves')
FAQ
Is .env.local safe?
If it is in .gitignore and you have confirmed it has never been committed (check `git log .env.local`). Safer is to never have .env.local at all on shared machines.