In programming, they often say: "if it works, don't touch it." But in reality, it is important not only that it "works", but also that no outsiders have gained access to the database, keys, logs, or user data.
If you want to be not just a developer, but reliable a developer, here is a list of typical fails that can really cost you your job — especially when it comes to production.
❌ Fatal mistakes for which you can really get fired
Error 🧨 | What can happen 📉 |
|---|---|
Commit secret key to Git | Loss of access to infrastructure, storage hacking |
Open database without authorization | Leakage of users' personal data |
API keys in JS on the front | An attacker can use them |
Ignoring CORS, CSRF, XSS | Threats of data tampering, session theft |
No logging of hacking attempts | You won't even know you've been attacked |
Logs with passwords, tokens, or cards 💳 | Direct violation of the law (e.g., GDPR) |
🔍 Where do they most often "leak the product"?
.env files in git - forget it once and for all. Add
.envto.gitignore.Open S3 buckets / GCS buckets - how to open all company documents for the Internet.
Public GitHub with token — your AWS account can be hacked in a couple of minutes.
Direct SQL query without escaping — classic: SQL injections.
Identical passwords for admins and users - especially fun if it's
admin:admin.
✅ What every developer should know (and check in reviews)
What you need to know 📚 | How to prevent ❗️ |
|---|---|
What is .env and why gitignore | Always check |
How authorization and authentication work | Use JWT or OAuth2, do not store passwords in the code |
What is CORS, CSRF, XSS | Add protection headers, check tokens |
How to encrypt data | bcrypt, AES, TLS. Passwords — only in the hash |
Logs and monitoring | Do not write sensitive data in product logs |
🧠 Real-life cases
Uber (2016) — AWS token in a private repository. The data of 57 million users has been leaked.
GitGuardian (2023) — recorded more than 10 million key leaks in open repositories.
Startup Dev → Telegram bot — commit '.env', after 24 hours the bot sends 40,000 spam messages.
🛡 Checklist before push to prod
✅ All '.env' and keys in '.gitignore'
✅ Checking tokens through GitGuardian
✅ CORS, CSRF, XSS testing
✅ Protected 403 and 401 on private routes
✅ Logs without tokens and passwords
✅ Passwords are hashed
✅ Access to the database via VPN
✅ Old tokens removed
✅ Minimum access rights
🤖 And if you are a beginner?
Such mistakes are easy to make if you are learning - but it is better to develop safe habits.
In the attachment Code you will find exercises on the topics: .env, working with tokens, secure input, setting up rights, secure password storage, and much more.
Don't just write code, write secure code.
Have you ever accidentally committed .env? Or do you want to become safer in the code? Write to us, and we will make an article about security in the front, back, or DevOps ✍️