Separate public configuration from secrets
Values such as a public API endpoint or feature flag may be safe to include in browser code, but passwords, private tokens, and signing keys are not. Anything bundled into client-side JavaScript can be inspected by visitors.
Use the hosting platform's documented environment configuration for server-side secrets and keep development, preview, and production values distinct. Do not commit real credentials into a repository, build log, or example file.
Rotate and verify carefully
When a secret is exposed or a team member's access changes, replace the credential at its issuing service and update the hosting configuration. A new deployment or process restart may be needed before the application uses the updated value; follow the platform's behavior.
After updating, check the application without printing the secret in logs or pages. Verify that required integrations still work, remove obsolete values from the configuration, and review access to deployment settings periodically.