Configuration and secrets
Keep runtime configuration environment-scoped, secrets write-only, and every change auditable.
Use service Variables
Plain configuration and secret references belong to the selected service and environment. Changes create a new deployment when required.
Protect secrets
Never place tokens, passwords, or generated credentials in prompts, URLs, screenshots, logs, or ordinary variables.
Use typed bindings
Bind databases, queues, and object storage to named consumers after the provider reports ready.
Separate environments
Production is the default. Select staging or another environment explicitly and verify the badge before editing values.