The single most common mistake in a student's first AI project is a hardcoded API key, committed to a public GitHub repo, found by an automated scanner within hours.
The fix, once, at the start
- All keys and secrets live in a .env file, never committed — add it to .gitignore before you write a single line that uses a key.
- Load secrets via a library (python-dotenv or your framework's built-in config) rather than reading files manually.
- In production, use the hosting platform's environment-variable settings, not a .env file shipped with the deployment.
- If a key does leak, rotate it immediately — assume it's compromised the moment it's public, don't wait to see if it's misused.
One habit that prevents most of this
Write the .gitignore entry before you create the .env file, in the same sitting, so there is never a window where the key exists unprotected in your working directory.
See secrets management for student projects for the deeper version of this.
GenAI engineer and AI product builder with 2+ years shipping production-grade AI systems: RAG pipelines, fine-tuned LLMs, hybrid retrieval and multi-modal apps across vision, speech and OCR, architected end to end from ingestion to deployment. Leads engineering for SCULT INDIA's 14-member team, founded the 500+ member TechVerse Enclave community and has mentored 200+ students. Three hackathon first prizes: Changethon 2025 (IIT Roorkee), Product Genesis at Vividhotsava 2025 (CSJMU Kanpur) and BYTEBATTLE (MeetKats).
Open to GenAI roles, hackathon judging, mentorship sessions and guest talks at colleges. Email pranjulrathour41@gmail.com.
