---
title: "Secrets and configuration · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/secrets-and-configuration
parts: 9
tokens_total: 7448
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1016
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Secrets and configuration

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Application security](https://agentwranglers.se/playbook/application-security.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Keep keys out of code and pages and give each key the least power. Close debug doors and hidden files, and keep servers current and quiet.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- APS-60 [Keep secrets out of code](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/secrets-out-of-code.md) · 1,150 tokens · updated 2026-10-27
  Never write a password, key or token into code, settings files in the repo, or its history.
- APS-61 [Keep secrets out of the browser](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/secrets-out-of-browser.md) · 798 tokens · updated 2026-10-27
  Send no private key to the browser. Anything in a page, script or source map can be read by anyone.
- APS-63 [Keep storage buckets private](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/private-storage-buckets.md) · 818 tokens · updated 2026-10-27
  Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.
- APS-64 [Close debug and admin doors](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/close-debug-doors.md) · 704 tokens · updated 2026-10-27
  Remove debug, test and status tools from production, or put them behind a login and a private network.

## Recommended

- APS-62 [Give each key the least power](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/least-privilege-keys.md) · 1,046 tokens · updated 2026-10-27
  Give every key, account and service only the access it needs. Use a separate key for each service and each environment.
- APS-65 [Serve no hidden files](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/no-hidden-files.md) · 634 tokens · updated 2026-10-27
  Serve only the files you meant to publish. Never serve version control folders, settings files, backups or folder listings.
- APS-66 [Remove defaults and samples](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/remove-defaults.md) · 595 tokens · updated 2026-10-27
  Change every default password and remove sample apps, admin consoles and test pages before going live.
- APS-67 [Keep software current and quiet](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions.md) · 916 tokens · updated 2026-10-27
  Keep the system, server and runtime on versions their makers still support. Install their security updates by the deadlines in [fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md). Don't tell visitors which versions you run.
- APS-68 [Remove DNS records you no longer use](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/dangling-dns.md) · 787 tokens · updated 2026-10-27
  Delete every DNS record that points at a server, bucket or hosted service you no longer own, before you give that resource up.

- Previous: [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md)
- Next: [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)
- [All chapters](https://agentwranglers.se/playbook/application-security.md)