Secrets Management

One practical note before we move on: never put API keys or passwords in files that AI can read.

Claude Code reads your project files. If you put secrets in .env, they end up in conversation history. Instead:

• Environment variables in your shell profile — add to ~/.zshrc so they're available as $VAR_NAME without Claude seeing the value
• Secrets manager — tools like secret-lover store secrets in the macOS Keychain with Touch ID protection
• .secrets.json — a file that tells Claude what secrets exist without exposing values

This is a habit worth building now, before it matters.