← VCE Software Development U4O2

Managing secrets outside source code

Keeping passwords, API keys and tokens in a protected vault or environment variable, not in source code, and rotating keys and scanning commits for leaks.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 67, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 55, WA Computer Science ATAR Year 11 — Cyber Security — Module 178

Understanding Managing secrets outside source code in VCE Software Development U4O2

What it does: Listing .env in .gitignore stops Git from tracking the file that holds the secrets, so they are not committed. Rotating a key issues a new secret and retires the old one, which limits the damage if the old key has leaked. Secrets belong in protected configuration or a vault so they are not exposed to anyone who can read the code or repository. Version control keeps history, so a committed secret stays exposed even if it is deleted in a later commit. Rotation does not prevent theft, but it reduces the window of time in which a leaked key is useful to an attacker.

Common mistakes: The API key is hard-coded in the source, so anyone who can read the code or repository can steal it. It should be read from an environment variable: key = os.environ["API_KEY"]. Putting # in front turns the rule into a comment, so Git no longer ignores .env and the secrets in it can be committed. The line should be .env.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Managing secrets outside source code to a class →

This module's key terms are also in a printable crossword (Modules 49–72) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Where should an API key for a payment service be stored?

In a constant at the top of the source code fileIn an environment variable or secrets vault

Matches

API_KEY = "sk_live_51Hx9a7"

↓

The API key is hard-coded in the source code, so anyone with repository access can see and misuse it. It should be loaded from an environment variable or a secrets vault.

Applying

Meanings

Term

secrets management

Meaning

Keeping passwords, API keys and tokens in a protected vault or environment variable, not in source code, and rotating keys and scanning commits for leaks.

Practice

import os

Testing

Gaps

key = os.("APIKEY")

Check Answer

Spots

1import os

2key = "sk_live_9f8a7b6c"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Where should an API key for a payment service be stored?

A. In an environment variable or secrets vault ✓

B. In a constant at the top of the source code file

Secrets belong in protected configuration or a vault so they are not exposed to anyone who can read the code or repository.

2. A developer commits a database password to a shared repository. What is the main problem?

A. Anyone with repository access, now or later, can read it in the commit history ✓

B. The password will stop working once it is committed

Version control keeps history, so a committed secret stays exposed even if it is deleted in a later commit.

3. Which statement about rotating keys is correct?

A. Replacing keys regularly limits how long a stolen key can be used ✓

B. Rotating keys makes them impossible to steal

Rotation does not prevent theft, but it reduces the window of time in which a leaked key is useful to an attacker.

4. What does a secrets scanning tool do on a commit?

A. Encrypts every file in the repository automatically

B. Checks the changes for passwords, keys and tokens before they are pushed or merged ✓

Scanning tools detect patterns that look like secrets so they can be blocked or reported before they spread.

5. A key was accidentally pushed to a public repository. What is the best response?

A. Delete the file in a new commit and carry on

B. Revoke and rotate the key, then investigate any misuse ✓

The key remains in history and may already be copied, so it must be treated as compromised and replaced.

Match the Pairs

API_KEY = os.environ["API_KEY"] → Reads the API key from an environment variable at run time, so the secret is not written in the source code

git secrets --scan → Scans commits and files for passwords or keys before they are pushed, so leaked secrets are caught early

Secrets should be stored in a .env file that is excluded from version control, so they never reach the repository → .env

Keys should be rotated regularly, so a leaked or stolen key stops working once it is replaced → vault.rotate("payment-api-key")

API_KEY = "sk_live_51Hx9a7" → The API key is hard-coded in the source code, so anyone with repository access can see and misuse it. It should be loaded from an environment variable or a secrets vault.

git add .env git commit -m "add config" → The .env file containing secrets is committed to the repository. It should be added to .gitignore, and any leaked keys should be rotated.

Key Term

secrets management

Keeping passwords, API keys and tokens in a protected vault or environment variable, not in source code, and rotating keys and scanning commits for leaks.

Fill in the Blanks

1. key = os.getenv("API_KEY")

Hint: Type the os function that reads a value from an environment variable instead of hard-coding it.

2. if not api_key: raise ValueError("Key missing")

Hint: Type the keyword that negates the check, so the code stops when the secret was not loaded.

3. echo .env >> .gitignore

Hint: Type the name of the local file that stores secrets and must be listed in .gitignore so it is never committed.

4. vault.rotate("db_password")

Hint: Type the method name that replaces an existing secret with a fresh value on a regular schedule.

5. if len(leaks) > 0: block_commit()

Hint: Type the comparison operator that checks whether the commit scan found at least one leaked secret.

Spot the Error

Question 1

A import os

B key = "sk_live_9f8a7b6c"

C headers = {"key": key}

Line B — The API key is hard-coded in the source, so anyone who can read the code or repository can steal it. It should be read from an environment variable: key = os.environ["API_KEY"].

Question 2

A node_modules/

B *.log

C # .env

Line C — Putting # in front turns the rule into a comment, so Git no longer ignores .env and the secrets in it can be committed. The line should be .env.

Question 3

A created = key_info["created"]

B age = (today - created).days

C if age < 90:

D rotate_key()

Line C — The comparison is the wrong way round. The key would be rotated while it is still new and old keys would never be rotated. Keys older than 90 days should be rotated, so it should be if age > 90:.

Question 4

A secrets=$(scan_staged_files)

B if [ -n "$secrets" ]; then

C echo "Secret found!"

D exit 0

E fi

Line D — Exiting with 0 tells Git the hook succeeded, so the commit goes ahead even though a secret was found. A pre-commit hook must exit with a non-zero code such as exit 1 to block the commit.

Question 5

A key = os.environ("API_KEY")

B log("Calling API")

C r = call_api(key)

Line A — os.environ is a dictionary-like object, not a function, so calling it with brackets causes an error. It should be looked up with square brackets: os.environ["API_KEY"].

Student with a class code? Join your class →