Never commit API keys, SSH keys, private certificates, databases, backups or .env files. Set a unique JWT_SECRET, change the bootstrap password, use TLS, and keep DB/backups private.