Keys and passwords in code
Never write passwords, tokens or access keys directly into program files or push them to a repository. Keep them in a separate settings file or in environment variables, and add that file to your ignore list.
Security
Security
Security may seem like a topic for experienced developers, but beginners are just as much at risk. A practice project easily ends up in a public repository along with your email password, a script from a random forum gets run without being checked, and a library with a familiar-looking name turns out to be a fake. A few simple habits prevent most of these problems. This section covers the risks beginners run into most often, plus the basics of open source licences.
A password that has ever made it into a public repository's history should be treated as known to everyone — and changed at once.
How this section works: we describe risks in general terms, without naming programs or services and without invented statistics. Information about licences is general guidance, not legal advice.
Beginner risks
Six situations that are easy to fall into in your first months of learning.
Scripts from the internet
Do not run code you do not understand, especially commands that ask for administrator rights or download something extra. Read the script first and work out what it does.
Fake packages
Attackers publish libraries with names similar to well-known ones, counting on a typo. Check the name against the official documentation and see who maintains the package.
Outdated dependencies
Old library versions can contain vulnerabilities that newer ones have fixed. Update your dependencies from time to time and read what has changed, especially when the major version number changes.
Weak passwords
Your account on a repository hosting service protects all of your code. Use a long, unique password, a password manager and two-factor authentication.
A public repo with personal data
Screenshots, data exports, addresses, phone numbers and work documents in a public repository are visible to everyone. Before publishing, review which files will end up in the history, and keep anything personal in private repositories.
Open source and licences
Open source means programs whose source code is available to everyone under an open licence. Such a licence allows you to use, study, modify and distribute the code, but under certain conditions: for example, keeping the authorship notice or publishing changes under the same licence.
The Open Source Definition is maintained by the Open Source Initiative, a non-profit organisation founded in 1998. If you bring someone else's code into your project, read its licence and meet its conditions. If you publish your own, choose a licence explicitly: without one, other people cannot tell what they are allowed to do with your code.
Related sections
- Errors
Command not found, syntax error, a program that stays silent, a merge conflict, lost changes — what to check first.
- Tools
A brand-free beginner's kit: code editor, terminal, interpreter or compiler, version control, repository hosting and a package manager.
- Questions
Answers about this reference, learning from scratch and your first hands-on projects.
Sources
- Open Source Initiative — The Open Source Definition
- Git documentation
Dates and definitions are taken from official documentation and specifications as of the preparation date. Languages and tools keep evolving, so check the details in current primary sources.