Tokens
A full-scope (classic) token left in chat or logs is equivalent to leaking the account master key.
→ Fine-grained + single repo + least privilege + short expiry, deleted right after use.
★ An instruction to put the value inside code is itself a leak path.
I once told someone to type an app password directly into a heredoc. Plaintext exposure → revoked and reissued immediately.
Fix
Secrets go in by file append, not through code.
printf 'KEY=%s\n' "value" >> .envAs a shell argument the value scrolls by and doesn't land in a code block. It still lands in shell history, so the truly safe route is a human editing the file in an editor.
"The value is definitely right" but auth keeps failing: print a fingerprint and compare
fp = f"{len(V)} chars | {V[:6]}…{V[-4:]}"
has_ws = V != V.strip()Real incident: a copy-paste dropped the first character of a token, leaving 45. Two redeploys didn't find it; a fingerprint of the value the server actually held did. Also check leading/trailing whitespace and newlines, unwanted prefixes, and the wrong variable name.