AI Coding Tools - lesson 3 | HackIndia Skills

Key point

One rule

Never paste or commit real secrets. A secret is anything that lets someone access money, data, accounts, servers, or APIs as you.

AI coding assistants can use open files, chat history, and repo context. Keep keys out of files the assistant can read unless your tool and repo settings intentionally exclude them.

What counts

Common secrets include API keys, database URLs, JWT secrets, OAuth client secrets, service account JSON, private keys, access tokens, SMTP passwords, and payment gateway keys.

For Indian hackathon projects, watch for Razorpay test keys, Firebase configs, MongoDB Atlas URLs, Supabase service role keys, Twilio tokens, and cloud credentials. Even test keys should not be public.

Your to-do

Store them safely

Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.

Put real values in a local .env file.
Add .env and other secret files to .gitignore before your first commit.
Create .env.example with fake values so teammates know what to configure.
Read secrets from environment variables in your app code.
Regenerate any key that was committed, even if you removed it later.

0 of 5 done

Example

Safe env setup

Commit the example file. Do not commit the real one. Your README can tell judges to copy .env.example to .env and add their own values.

# .gitignore
.env
.env.local
*.pem
service-account.json

# .env.example
MONGODB_URI="your_mongodb_connection_string"
RAZORPAY_KEY_ID="your_razorpay_key_id"
RAZORPAY_KEY_SECRET="your_razorpay_key_secret"
JWT_SECRET="change_this_for_local_dev"

Example

Read, do not hardcode

This pattern keeps secrets outside code. If an AI assistant suggests hardcoding a key, reject that part and ask for environment-variable based code.

// Node.js example
const express = require("express");
require("dotenv").config();

const app = express();

const mongoUri = process.env.MONGODB_URI;
if (!mongoUri) {
  throw new Error("Missing MONGODB_URI in environment variables");
}

// Use mongoUri to connect. Do not paste the real URI here.

Common mistake

Bad AI prompt

Do not paste a real .env file into ChatGPT, Gemini, Claude, Copilot Chat, or any shared chat. OpenAI also warns not to include passwords, financial details, account numbers, or other sensitive personal information in shared content.

Ask the assistant to review filenames and patterns instead. If you use ChatGPT, Temporary Chat does not show in history and is not used to train models, but you should still avoid entering secrets.

Bad:
Here is my .env. Fix my Razorpay integration: RAZORPAY_KEY_SECRET=rzp_secret_real_value

Better:
Review this code for hardcoded secrets. Do not ask me to paste secret values. Check for env variable usage and missing .gitignore entries.

Tip

Use AI safely

Ask AI to create a secret checklist for your repo, then verify it yourself. AI can miss things, and current guidance says you are responsible for reviewing generated code before accepting it.

If your tool supports content exclusion, use it for sensitive files. Remember that excluded files do not inform suggestions or code review, so do not expect the assistant to understand those values.