• ✅ Use environment variables for ALL credentials
• ✅ Copy .env.example to .env and add your credentials there
• ✅ Keep .env in .gitignore (already configured)
• ✅ Use process.env.VARIABLE_NAME in your code
• ✅ Review your commits before pushing (git diff)
• ✅ Use placeholders when asking AI assistants for help

• ❌ Never hardcode API keys in your code
• ❌ Never commit .env files
• ❌ Never share credentials in code comments
• ❌ Never commit files with "credential", "secret", or "password" in the name
• ❌ Never remove patterns from .gitignore or .bobignore
• ❌ Never paste credentials in AI assistant prompts

AI assistants log your prompts and code in session history files. If you share credentials with them, those credentials may be logged!

❌ BAD:  "Here's my API key: abc123xyz, help me use it"
✅ GOOD: "Help me use environment variables for my API key"

❌ BAD:  "Read my .env file and help me debug"
✅ GOOD: "Help me structure my .env file (I'll add credentials myself)"

❌ BAD:  api_key = "abc123xyz"
✅ GOOD: api_key = os.getenv('API_KEY')

• .bobignore prevents Bob from logging credential patterns
• .gitignore prevents session files from being committed
• But YOU must not share credentials in prompts!

If you accidentally commit credentials:

1. Your IBM Cloud account will be suspended immediately
2. You must remove the credential from repository history
3. You must rotate/revoke the exposed credential
4. Your account will be restored after verification

require("dotenv").config();
const apiKey = process.env.IBM_CLOUD_API_KEY;

import os
from dotenv import load_dotenv
load_dotenv()
api_key = os.getenv('IBM_CLOUD_API_KEY')

String apiKey = System.getenv("IBM_CLOUD_API_KEY");

• No hardcoded credentials in code
• .env file is NOT staged for commit
• No files with credentials in their name
• Reviewed git diff for sensitive data
• All credentials are in environment variables
• No credentials shared with AI assistants

Contact hackathon support through the mentor channel.

• GitHub Security Best Practices
• IBM Cloud Security
• Environment Variables Guide