System Design · Middle · Question 73 of 75

How should secrets (API keys, DB passwords) be managed in a deployment?

✓Correct answer: Inject them from a secrets manager or environment at runtime, restrict access and rotate them; never commit them
2Hard-code them in the source
3Store them in the frontend bundle

Explanation

Leaked secrets in Git history persist after deletion; secret scanning in CI catches mistakes early.

Further reading

Test yourself

Take the System Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.