Default
Door staff@engadget.com (Kate Irwin) - 01 Nov 2026
It's never a good idea to put API keys or passwords directly into an AI prompt. This type of sensitive data should never show up in the code, either, because if you push your code to Github later, all that critical info will be available for anyone to see. Limiting what your AI tool has access to can also help prevent prompt injection attacks.
Instead, store sensitive data in a dedicated password manager and use the "environmental variables" or "secrets" tabs on Replit, Lovable or Vercel. This is the easiest and best method for total beginners.
If the AI tool you're using doesn't have a feature like this built-in already, you will have to make a backend "environmental variable" .env file for this data and make sure that file does not get made public at any stage in the process. This means making it part of a .gitignore file and ensuring it is never visible on the app or website's frontend.
To check if you've done this correctly, you can use TruffleHog, a tool that will check your code to make sure you haven't accidentally leaked sensitive info.
Instead, store sensitive data in a dedicated password manager and use the "environmental variables" or "secrets" tabs on Replit, Lovable or Vercel. This is the easiest and best method for total beginners.
If the AI tool you're using doesn't have a feature like this built-in already, you will have to make a backend "environmental variable" .env file for this data and make sure that file does not get made public at any stage in the process. This means making it part of a .gitignore file and ensuring it is never visible on the app or website's frontend.
To check if you've done this correctly, you can use TruffleHog, a tool that will check your code to make sure you haven't accidentally leaked sensitive info.