Case studies / Config & secrets
Secrets and debug mode in production
Fintech MVP, Laravel 11
Redacted case study. How a pre-launch configuration audit found live API credentials in the repository and stack traces leaking to end users.
Redacted case study. How a pre-launch configuration audit found live API credentials in the repository and stack traces leaking to end users.
A fintech startup was days from onboarding its first paying customers when the CTO requested an emergency audit ahead of an investor demo. The app processed real financial data.
A three-day Sprint focused on configuration hardening, secrets management, and authentication — the areas most likely to surface immediate compliance blockers.
Debug mode was enabled in production, exposing full stack traces including database credentials to any user who triggered an error:
The .env file was also accessible via a misconfigured web server and a copy had been committed to the repository, exposing the Stripe live key to anyone with repo access.
Debug disabled, secrets rotated before the investor review, .env removed from git history and blocked at the web root. App launched clean.