Secrets Management Solo Developer: A Practical Guide

TL;DR: How should solo developers manage secrets and env vars?

Solo developers should manage secrets and environment variables by using a dedicated secrets manager (like HashiCorp Vault, AWS Secrets Manager, or Doppler) instead of hardcoding them in source code or .env files. Store only a single master key or service token in your local environment, and load all other secrets dynamically at runtime. Never commit secrets to Git, even in private repos. For small projects, a simple encrypted vault (e.g., git-crypt, sops) combined with environment-specific .env files (kept out of version control) is a practical starting point. This approach protects your API keys, database credentials, and tokens from accidental exposure while keeping your workflow simple.

Why secrets management matters for solo developers

As a solo developer, you might think: "I'm just building a side project, who would attack me?" But security breaches often start with automated scanners scraping GitHub for exposed keys. A single leaked AWS secret can cost you thousands of dollars in minutes. Moreover, with AI coding tools like Cursor or Copilot, you might inadvertently paste secrets into prompts. Proper secrets management solo developer practices are not about paranoia—they're about protecting your time, money, and reputation.

Common mistakes and how to avoid them

1. Hardcoding secrets in source code

# BAD: Hardcoded API key
api_key = "sk-1234567890abcdef"

Fix: Use environment variables and load them at runtime.

# GOOD: Load from environment
import os
api_key = os.environ.get("API_KEY")
if not api_key:
    raise ValueError("API_KEY not set")

2. Committing .env files to Git

Even if you add .env to .gitignore, it's easy to accidentally force-push or include it in a Docker build. Use .env.example as a template instead.

3. Sharing secrets via chat or email

Never paste secrets in Slack, Discord, or email. Use a secure sharing service like 1Password or Keybase.

Step-by-step: Setting up a simple secrets workflow

For local development

# Example with Doppler
doppler setup  # Interactive setup
doppler secrets set DB_PASSWORD=mypassword
doppler run -- python app.py  # Runs with DB_PASSWORD in env

For production (e.g., Vercel, Railway, Fly.io)

Most platforms have built-in secrets management. Use their UI or CLI to set env vars.

# Vercel example
vercel env add PLAIN_API_KEY

Using a local encrypted vault (alternative)

If you prefer not to use a cloud service, use sops (encrypted files) or git-crypt.

# sops example
sops --encrypt .env.prod > .env.prod.enc
# Store the decryption key in a password manager

Then in your app:

import subprocess
import os

# Decrypt at runtime (only if key is present)
subprocess.run(["sops", "--decrypt", ".env.prod.enc", "--output", ".env.prod"])
from dotenv import load_dotenv
load_dotenv(".env.prod")

Best practices

How OverMCP can help

While managing secrets is critical, it's only part of the security picture. OverMCP (overmcp.com) scans your vibe-coded apps for exposed secrets, misconfigurations, and vulnerabilities—before you deploy. It integrates with your CI/CD pipeline and alerts you if a secret leaks.

FAQ

What's the easiest secrets management solution for a solo developer?

Start with a cloud secrets manager like Doppler or Railway's built-in env vars. They offer a free tier and are trivial to set up. If you need offline access, use sops with a GPG key stored in your password manager.

Can I just use .env files and never commit them?

Yes, for small projects. But ensure your .gitignore is correct, and never share the file. For production, use the platform's env var system. The risk is accidental exposure (e.g., backing up the repo to cloud storage).

How do I handle secrets in CI/CD pipelines?

Most CI tools (GitHub Actions, GitLab CI) have built-in secrets storage. Set your secrets there and reference them as environment variables. For example, in GitHub Actions: ${{ secrets.DB_PASSWORD }}.

# .github/workflows/deploy.yml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - run: echo "${{ secrets.SUPABASE_URL }}" > .env
      - run: npm run build