AI projects move fast, and credentials get pasted wherever they are needed: notebooks, shared documents, environment files committed by accident. The cost arrives later, as unexpected bills or exposed data.
Practices
- Keep secrets in a secrets manager or environment files excluded from version control.
- Scan repositories and history for keys, automatically, on every commit.
- Use separate keys per environment and per service, with spending limits.
- Rotate on a schedule and immediately after any suspected exposure.
- Never put keys in prompts, client-side code or logs.
Assume a key that has ever been in a repository is compromised. Rotate it, don't just delete the file.