From chat to the terminal|INEMA.CLUB-PRO

Lesson 5 · 14 min

Keep secrets out of the text

A key pasted into a document, a screenshot, or a request gives access to anyone who reads it, and it stays valid after the conversation ends. Separating the secret from everything else before saving the first version lets you share the folder without worry.

Start the lesson
A hand holding a key ring in front of a building concierge’s key board, with a safe in the background.

In this lesson, you will

  1. 1.env stores the key; .env.example shows only the names
  2. 2.gitignore written before the first version
  3. 3Leaked? Replace the key at its source first
  4. 4The AI needs the variable name, not the value

Objective: create .env, .env.example, and .gitignore before the first commit, and know what to do if a key leaks.

01The concierge’s key board

The room list can be visible; the key cannot.

Scroll down: each step below lights up its part of the diagram.

  1. 1/5

    .env

    Stores variables: a name, an equal sign, and a value. It is not a safe: it is not encrypted, and anyone who opens the file can read it. So keep it only on your machine and never put it in Git.

  2. 2/5

    .env.example

    The same names, with fake values. Anyone who gets the project can see what they need to fill in, but they do not get access to anything. Remember: anything ending in example is the example.

  3. 3/5

    .gitignore

    Each line is a pattern. .env matches the file; .env.* matches variants like .env.local; the line with ! makes an exception and puts .env.example back on the list of files to save.

  4. 4/5

    History

    .gitignore only applies to files Git has not saved yet. If .env is already in a commit, adding the line later does not remove it from the history. That is why the list comes before the first version.

  5. 5/5

    Ignore before the first commit

    The .env with the real value stays at home, .env.example can be shared, and .gitignore decides this before Git saves any version. Once the mailbag has left, crossing the paper off the list will not bring it back.

The AGENTS.md rule says: "Never write keys or passwords in a text file; keep them in .env."

02Four rules about secrets

Click each one.

1. A credential is the key to the room

A password, API key, and bot token let whoever has them act on behalf of your account, and you pay the bill.

Before sending a screenshot, check the corners of the screen: a visible password belongs to everyone who receives it.

Screenshot with password coveredThe same screen, with the password covered before sending.

03The three files

In the meu-primeiro-agente folder. The key is fake, for practice.

cmd · create the practice .env and .gitignore
cd %USERPROFILE%\projetos\meu-primeiro-agente
echo MINHA_CHAVE=teste123> .env
echo MINHA_CHAVE=preencha_localmente> .env.example
echo .env> .gitignore
echo .env.*>> .gitignore
echo !.env.example>> .gitignore
type .gitignore
.gitignore (what should be inside)
.env
.env.*
!.env.example
AGENTS.md · new rule
- Never write keys or passwords in a text file; keep them in .env.
- If you need a key, mention the variable name, never its value.
Simulation: illustrative example
C:\Users\ana\projetos\meu-primeiro-agente> type .gitignore
.env
.env.*
!.env.example

One > creates the file (or replaces its contents); two >> add a line at the end.

04Rehearse: keep the secret out of text

Create the files and check the list.

Missions

  1. 1Create .env with the fake key MINHA_CHAVE=teste123.
  2. 2Create .gitignore with the line .env (with no space before >).
  3. 3Add the line .env.*.
  4. 4Add the exception !.env.example.
  5. 5Show .gitignore.
Command Prompt · simulation
Simulation: the commands are the same in your cmd.
05Practice
Before any git commit.
E9 · Keep secrets out of text
10 min
Create .env with the fake key, .env.example with the pretend value, and .gitignore with the three lines. Add the rule to AGENTS.md.
Done when: type .gitignore shows .env, .env.* and !.env.example, and no file other than .env has the value teste123.
E10 · Rehearse a leak
5 min
For each credential you use (subscription, token, key), write down on the project sheet where you can replace it.
Done when: For each credential, you know which page lets you revoke it and create another, without having to search in a panic.
06Test what you learned
The explanation appears after your answer.
Question 1 of 3
Where does an API key go in a project?competency
To learn more
OSWork v6.2: a secret isn’t knowledge to share
Previous lessonNext lesson