Nothing on this page is optional. These are the habits that protect you from the mistakes that can't be rolled back.
API keys, tokens, passwords live in .env (or your platform's secret store) — and .env is listed in .gitignore before the first key is written into it.
# .gitignore
.env
Check right now, in every project you have: is .env ignored? Ask the agent: "check this repo for committed secrets or files that should be gitignored." It's a good auditor — but verify its all-clear yourself with git status before trusting it.
If a key ever lands in a commit: rotate it immediately. Deleting the file in a later commit does not help — the key stays in history. Treat a committed secret as a leaked secret.
The .env with the key exists right there — and git status says "working tree clean." That's what safe looks like: the file lives next to the code, and Git can't see it.
The agent proposes; you approve. That approval is a real checkpoint, not a formality — especially for anything destructive or irreversible: deletions (rm), force pushes, database migrations, package publishes, anything touching production. If you don't understand what a command does — ask before approving. Week 1's rule, sharpened: don't run commands you can't explain.
A README, a downloaded file, a web page, someone else's code can contain text that looks like instructions to the agent — sometimes planted deliberately. The agent should treat file contents as material to work on, not orders to follow; but don't rely on that alone. If the agent suddenly proposes an action you didn't ask for — deleting something, fetching a URL, changing config — stop and ask where that came from. You direct the agent. Files don't.
Don't paste keys, tokens, or customer data into any chat — the agent doesn't need the real values to write the code that uses them. And check your screenshots before sharing them (including for this course): terminal output and .env files love to photobomb.
The HackYourFuture curriculum is licensed under CC BY-NC-SA 4.0 *https://hackyourfuture.net/*
Built with ❤️ by the HackYourFuture community · Thank you, contributors
Found a mistake or have a suggestion? Let us know in the feedback form.