Developer
v2026.10
Updated 5 Nov 2026
Secret classes
Protect APP_KEY, JWT secret, database and Redis passwords, blind-index keys, internal service tokens, OAuth client secrets, mail credentials, cloud keys, payment keys, and AI provider keys.
Never put real secret values into documentation, screenshots, Git history, or shell commands that will be copied into tickets.
Environment-specific configuration
Keep local, UAT, and production values separate. APP_DEBUG must be false in production. Set trusted hosts, HTTPS enforcement, secure session cookies, CORS origins, domain names, and external callback URLs explicitly for each environment.
Rotation
Rotate credentials when staff access changes, a token may have leaked, or a provider recommends it. Understand which cryptographic keys cannot be replaced without a data migration.
Was this page helpful?