Secrets handling checklist for the TTS skill

Use this before the first live request and before sharing any artifact.

Local learning path

• I created .env.example with variable names only.
• My actual .env is ignored by Git and contains my own key only.
• I did not paste the key into a coding-agent prompt, source file, issue, chat, screenshot, log, receipt, or static site.
• I set a provider spending limit or alert before the live test.
• I will run a dry test before a live request.

Portable team option

For a team workflow that must travel across machines, store encrypted secret values with SOPS + age and inject them only into the process that needs them. Keep the age identity outside Git, limit access to named maintainers, and commit only encrypted values plus the non-secret setup contract. This is an option to study here, not a requirement for the first lab.

Deployment and CI option

Use the deployment or CI platform’s secret store. Inject the value only into the required job or server process. Do not place the secret in build artifacts, client-side configuration, static output, preview URLs, or browser code.

If exposure is suspected

1. Stop using the exposed key.
2. Revoke or rotate it in the provider account.
3. Remove access from the exposed location and invalidate dependent local configuration.
4. Record where it appeared without copying the value into the record.
5. Review the repository, logs, chats, and published artifacts for the exposure path.
6. Resume only with a new key and a corrected boundary.

Deleting a message or file alone does not make a credential safe again.

---

Source: labs/build-a-safe-text-to-speech-skill/materials/secrets-handling-checklist.md