Should an exposed production secret be fixed only by deleting it from the repository?
No. Revoke or rotate the exposed credential, review relevant access, and update dependent services because copies may remain in history, logs, or other locations.
Explore This Question
Search for additional explanations using these tools:
More FAQs in Why should development and production secrets be managed separately?
No. If both variables contain credentials with the same access, a development process can still reach production resources despite the different names.
Use isolated configuration and designated test recipients, with links pointing to the intended preview environment and credentials that cannot broadly affect production messaging.
Still have questions?
Browse all our FAQs or reach out to our support team