Separate configuration from source code
Applications commonly need different database URLs, log levels, API endpoints and feature flags in development, testing and production. These values should be supplied through configuration rather than hard-coded throughout the program.
Keep secrets out of Git
Passwords, API keys and signing secrets should be supplied through a secure environment or secret-management system. A value being hidden in an obscure source file is not a security strategy.
Fail clearly when required configuration is missing
It is usually better for an application to report a missing required database URL during startup than to fail later on the first database request with a confusing error.
Practice: configure an application name, environment and database URL through environment variables and validate required settings at startup.
ADVERTISEMENT