Interview question
How do you securely store and manage sensitive configuration like API keys? API keys जैसी sensitive configuration को securely कैसे store करें?
Answer
Sensitive credentials should never be hardcoded in source code or committed to version control. Use environment variables instead.
// .env file (added to .gitignore, never committed)
DB_PASSWORD=secret123
STRIPE_SECRET_KEY=sk_live_xxxxx
// Loading in PHP
$dbPassword = getenv('DB_PASSWORD');
// Or in Laravel
$stripeKey = config('services.stripe.secret');| Bad practice | Good practice |
|---|---|
| Hardcoding keys in .php files | Reading from environment variables (.env) |
| Committing .env to git | Adding .env to .gitignore |
| Same credentials for dev/prod | Separate credentials per environment |
For production, consider dedicated secret managers (AWS Secrets Manager, HashiCorp Vault) for extra rotation and access-control capabilities.
Sensitive credentials को source code में hardcode या version control में commit नहीं करना चाहिए। Environment variables इस्तेमाल करें।
// .env file (.gitignore में)
DB_PASSWORD=secret123
STRIPE_SECRET_KEY=sk_live_xxxxx
$dbPassword = getenv('DB_PASSWORD');
// Laravel में
$stripeKey = config('services.stripe.secret');Was this answer clear?