deploy-secrets-zero-exposurelisted

# Deploy Secrets — Zero Online Exposure **Golden rule:** Local keys on your machine are fine. **Nothing secret may exist on the server in a path that HTTP can reach** — not for anonymous visitors, not for logged-in users who lack admin ops rights. This skill applies to **all stacks** (Laravel, Next.js, Perfex, Slim PHP, static sites). ## When to invoke - Before **first production deploy** or any deploy to a client domain - When adding **ops utilities** (`fix.php`, setup wizards, debug routes) - When configuring **web server / Vercel / cPanel** document root - After **git pull** on production - User asks: "is this safe to deploy?", "security check", "secrets online" ## Non-negotiable rules | Rule | Why | |------|-----| | `.env` and env backups **never** in web root or git | Direct download = full compromise | | API keys, PATs, DB passwords **never** in source, config committed to git, or JS bundles | Repo leak + browser DevTools | | `.git/` **never** web-accessible | History contains every past secret | | `_deploy/`, `key.*.md`, credential files **gitignored**; never uploaded to hosting | One wget away from disaster | | Ops files (`fix.php`, `phpinfo.php`, setup scripts) **auth-gated** or **404 when disabled** | Shared hosting scans these constantly | | `APP_DEBUG=false`, no stack traces to users in production | Errors leak paths and queries | | Secrets only via **server env** or **files outside document root** | Build artifacts must not embed keys | | Clean git remote U