Two different things in one file
Configuration says how the system behaves; secrets grant access. Treating them identically is how a database password ends up in a repository and a feature flag ends up in a vault.
Secrets never live in the repository
Not in code, not in a committed file, not in a comment. Once committed, a secret is in the history permanently and must be rotated rather than deleted — assume any secret that has ever been in a repository is compromised.
Deleting a committed secret removes it from the file, not from history. Rotate it.
Configuration should be explicit and comparable
You should be able to see, side by side, what differs between environments. Most environment-specific incidents are one setting nobody compared — the reason environments only help when the differences are documented.
Fail loudly on missing values
A system that starts with a missing setting and silently uses a default is how the wrong service gets called in production. Validate required configuration at startup and refuse to run without it.
Scope every credential
One key per service, with only the permissions it needs, so one leak is not total. This is the same principle as scoping an AI teammate’s access — and it makes rotation possible without an outage.
Know who can see them
Access to production secrets is the most privileged thing in the company and often the least reviewed. Put it in the same access review as everything else, and log when they are read.