--- title: "Keep secrets out of code ยท Agent Wranglers" url: https://agentwranglers.se/playbook/application-security/secrets-and-configuration/secrets-out-of-code id: APS-60 level: Required risk: takeover updated: 2026-10-27 build: a2a6bdfed830 tokens: 1240 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Keep secrets out of code For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: APS-60 - Level: Required - Chapter: [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md) - Rule: Never write a password, key or token into code, settings files in the repo, or its history. - Check: The agent runs a secret scanner over the whole history, not only the latest commit. It finds no live key. - Risk: An account or system taken over - How: Read secrets from environment variables or a secret store at start-up. Add a secret scanner to the pre-commit hook and the build, as [Use TruffleHog to find leaked secrets](https://agentwranglers.se/playbook/stack/testing-and-code-quality/secret-scanner.md) says. A secret that ever reached the repo is leaked, so replace it, even after you delete the commit. ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### Shell example ```sh # gitleaks 8.19 or later scans every commit on every branch gitleaks git --redact --log-opts="--all" . ``` ## Sources - [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) ## Related rules - AID-15 [Read every line of the diff](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/read-every-diff.md) in AI-assisted development - ENG-66 [Send only the files the build needs](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/dockerignore.md) in Engineering - ENG-58 [Block pushes that contain secrets](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/secret-push-protection.md) in Engineering - ENG-22 [Keep settings outside the code](https://agentwranglers.se/playbook/engineering/running-in-production/settings-outside-the-code.md) in Engineering - ENG-26 [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store.md) in Engineering - API-80 [Give each environment its own provider key](https://agentwranglers.se/playbook/api-design/using-other-companies-apis/key-per-environment.md) in API design - INF-2 [Keep state remote with locking and encryption](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/remote-state.md) in Infrastructure and environments - INF-26 [Give services the identity of their machine](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/workload-identity.md) in Infrastructure and environments - STK-50 [Use TruffleHog to find leaked secrets](https://agentwranglers.se/playbook/stack/testing-and-code-quality/secret-scanner.md) in Software choices - DOC-13 [Generate the settings reference from one schema](https://agentwranglers.se/playbook/documentation/reference-and-changelogs/settings-reference.md) in Documentation - DOC-23 [Use only made-up data in docs](https://agentwranglers.se/playbook/documentation/examples-that-run/made-up-data.md) in Documentation - SUP-6 [Mask card numbers and secrets that arrive in tickets](https://agentwranglers.se/playbook/customer-support/inbox-and-tickets/mask-card-numbers.md) in Customer support - IOT-3 [Ship no shared secret in the firmware image](https://agentwranglers.se/playbook/connected-devices/device-identity/no-secrets-in-firmware.md) in Connected devices - OSS-20 [Publish only the files from the tagged source](https://agentwranglers.se/playbook/open-source/releases/publish-tagged-files-only.md) in Open source maintenance - OSS-41 [Deleting a published version that others depend on](https://agentwranglers.se/playbook/open-source/funding-and-the-end-of-a-project/no-unpublish.md) in Open source maintenance - TDD-7 [Scan the whole history for secrets](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/history-secret-scan.md) in Technical due diligence **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers application security playbook`. In code you write, add a comment next to it with the same link. - Next: [Keep secrets out of the browser](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/secrets-out-of-browser.md) - [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)