Protect station

Secrets & Dependabot

Keeping keys out of your code, and out-of-date packages from biting you.

1. Learn it

A key pasted into code and pushed to GitHub is public, even in a private repo mistake.
Secrets live in environment variables on the server; the browser never sees them.
Anything with VITE_ or NEXT_PUBLIC_ in the name IS visible to visitors. Read the name before you trust it.
Dependabot opens pull requests when a package you use has a known hole.

Cost: Free.

Simulated — nothing real happens

Three places hold an OpenAI key: a server file, a browser component, and an environment variable named VITE_OPENAI_KEY. Which two are leaks?

Real — your own account

Nothing to sign up for.

1Turn on Dependabot alerts in your GitHub repo settings; store keys in your host's secret manager.

MessyDev never signs you up, spends your money, or touches your accounts. You do that part.

Before your first real deploy, and every time you add a key.

There is no single correct stack. Any of these would be a reasonable choice instead.