Sharing Your Creation Safely

You built something real. You tested it. You got feedback. Now you are ready to share it. But sharing is not as simple as clicking 'publish.' Every time you release a project into the world, you make choices — about what data it collects, what code it exposes, what accounts it touches — that affect you and every person who uses it. Shipping responsibly means thinking through those choices before you press the button, not after something goes wrong.

What You Should Never Ship

Four categories of information must never appear in code you make public: 1. API keys and passwords. An API key is a secret credential that lets your code talk to a service like an AI model or a database. If you paste an API key into your code and publish the code on GitHub or any public site, anyone who finds it can use that service under your account — running up charges or accessing private data. API keys belong in environment variables, never in code. 2. Personal information. If users give you their name, email, age, or any other personal detail, you are responsible for it. Do not store it publicly. Do not share it with other services without telling users. 3. Other people's private data. If you built a project using sample data that contains real people's information — even if you found it online — do not ship it. 4. Content you do not have rights to. Images, text, or audio from other sources may be copyrighted. Using them in a public project without permission can create legal problems.

Here is a safe shipping checklist to run through before making any project public: Does my code contain any API keys, passwords, or tokens? If yes — move them to environment variables or a private config file that is excluded from your public repository. Does my project collect any personal data from users? If yes — are you storing it securely, and have you told users what you are collecting? Did you use any assets (images, fonts, audio) that you did not create yourself? If yes — do you have the right to use them publicly? Could anyone use your project to harm another person? If yes — that is a responsibility issue we cover in Lesson 8.

Environment Variables — The Safe Way to Handle Secrets

An environment variable is a piece of information stored on the server or computer where your code runs — not inside the code itself. Your code reads the variable by name, but the value is never visible in your source code. In most hosting platforms (like Vercel, Replit, or Glitch), you set environment variables through a settings panel. You give the variable a name (like OPENAI_API_KEY) and a value (your actual key). Your code reads it as a variable. The key never appears in any file you publish. This is not advanced practice — it is the baseline standard for any project that touches an API. Building this habit now, while your projects are small, means you will never accidentally expose a credential when the stakes are higher.