May 19, 2026
Shhh, Don't Put Secrets in the Repo
Let’s talk about app config and secrets.
Every web app needs a port, URLs, feature flags, API keys, OAuth secrets, maybe a service account JSON file, maybe a certificate and key.
Some values come from environment variables. Some come from local files. Some are defaults. Some are fetched from a secret manager. Some need to be written as files because the library using them expects a path.
The common answer I’ve been exposed to is to make the app orchestrate all of this. Add a config library and teach it where to look.
Well, that works, but now startup has its own rules. Does the env var override the file? Does the local profile override the default? Does the cloud secret replace the local one? To understand how the program starts, I have to understand the precedence rules inside the app.