What is Secrets in Code?
Credentials accidentally committed to repositories, chat logs, or client bundles where history preserves them forever. BYOB project secrets live in server environment, so agents request missing keys instead of pasting values.
Example
A deploy fails because a payment key is missing. Instead of pasting the value into chat or code, the developer adds it through project secrets, where server environment picks it up and presence checks turn green.
What people get wrong
Deleting a leaked secret from the latest commit and moving on. History preserves every version, so revocation plus rotation is the only fix after exposure.
Related terms
Project Secrets & Env Status
Safe key-presence checks and derived-variable application for projects. Agents request missing values explicitly; secrets land in project environment, never in chat logs or code.
OWASP Top 10
The community-ranked list of the most critical web application risks, refreshed every few years from real breach data. Teams use it to prioritize injection, broken auth, and misconfiguration fixes first.
Dependency Scanning
Automated auditing of third-party packages against vulnerability databases before and after deployment. Lockfiles, advisories, and CI gates turn newly disclosed CVEs into upgrade tasks instead of surprises.
Anon Key vs Service-Role Key
The public client key (safe in browsers, constrained by RLS) versus the privileged server key (bypasses policies, never leaves the server). Mixing them up is the classic Supabase security bug.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.