Secrets audit
Find every key and setting your app uses, confirm each secret lives only in .env.local, Vercel (as a Secret) and your password manager, scan your code and your whole Git history for leaks, and rotate the Resend key on purpose so the emergency drill is something you've already done.
Why this matters
In Lesson 6.5 you learned the secrets rules before you had any secrets. Since then you've added a database, an email service, an owner account and five modules of changes. You've pasted things, restarted servers, asked Cursor for help dozens of times. Somewhere in there, did a key slip into a file, a commit or a chat? You probably think not. Now you'll check, the way a professional does before every launch.
The second half of this lesson is a fire drill. You'll replace the Resend key with a new one, on purpose, while nothing is wrong. Fire drills feel silly until the day there's smoke. The first time you rotate a real leaked key shouldn't be at midnight, in a panic, on a client's live site. It should be today, calmly, on a practice app, with this lesson open.
In the full lesson
- The idea in plain English
- Do it
- Check it worked
- Understand what AI wrote
- Quick check
- What you can do now
The step-by-step, the prompt to copy, the video and the check-it-worked list, for every lesson in all 15 modules. GHS 399 ($40), paid once by mobile money or card, yours to keep.