TypeScript Academy · Lesson

Secrets and Type Safety

Handle sensitive values without leaking them into types.

Secrets and Type Safety is a free TypeScript Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the TypeScript Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Secrets Deserve Special Care

API keys, passwords, and tokens are config too, but leaking them in logs or error messages is dangerous. Type safety can help keep secret values from being accidentally exposed.

The Accidental Logging Problem

A plain string secret can be logged anywhere by accident, for example via console.log(config) or an error dump that serializes the whole config object.

const config = { dbPassword: "hunter2" };
console.log(config); // leaks the password

Branded Secret Types

A branded type tags a string as a secret at compile time, so the type system distinguishes a Secret from an ordinary string and forces deliberate handling.

type Secret = string & { readonly __brand: "Secret" };
function secret(s: string): Secret { return s as Secret; }

Why Branding Helps

Because a Secret is not assignable to a plain string without intent, functions can require a Secret where appropriate and you cannot pass it somewhere unsafe by mistake.

function connect(pw: Secret) { /* uses pw */ }
// connect("plain") -> type error; must wrap with secret()

A Secret Wrapper Class

An alternative wraps the value in a class whose toString and serialization are redacted, so even careless logging shows a placeholder.

class Secret {
  constructor(private readonly value: string) {}
  expose(): string { return this.value; }
  toString() { return "[REDACTED]"; }
}

Redacting in Serialization

Customizing toJSON ensures the secret never appears when an object is serialized with JSON.stringify, the most common accidental leak path.

class Secret {
  constructor(private readonly value: string) {}
  expose() { return this.value; }
  toJSON() { return "[REDACTED]"; }
}
// JSON.stringify({ pw: new Secret("x") }) -> {"pw":"[REDACTED]"}

Explicit Exposure Only

The real value is reachable only through an explicit method like expose(). This makes every point that reads a secret visible and auditable in the code.

const pw = new Secret("hunter2");
console.log(String(pw)); // [REDACTED]
connectToDb(pw.expose()); // deliberate access

Keep Secrets Out of Wide Types

Avoid putting raw secret strings into broad config interfaces that get logged whole. Use the Secret type so they are redacted by default wherever the config is printed.

interface Config {
  host: string;
  dbPassword: Secret; // not a plain string
}

Loading Secrets Safely

Wrap secret env values as you read them, so they are branded or boxed from the very first moment and never float around as plain strings.

const config = {
  host: process.env.DB_HOST!,
  dbPassword: new Secret(process.env.DB_PASSWORD!),
};

Defense in Depth

Type-level secrets reduce accidental leaks but do not replace good operational practice: restrict who can read env, avoid logging request bodies, and scrub error reporters.

Summary of Techniques

Use branded types to force deliberate handling, a wrapper class with redacting toString/toJSON, and an explicit expose() to read the value, keeping secrets out of logs and serialized output.

Quick Check

Quick check on this lesson.

Recap

Protect secrets with branded types (forcing deliberate handling) or a wrapper class whose toString/toJSON return [REDACTED], exposing the real value only via an explicit expose(). This keeps secrets out of logs and serialized config.

Frequently asked questions

Is the “Secrets and Type Safety” lesson free?

Yes — the full text of “Secrets and Type Safety” is free to read here on the web, and the TypeScript Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the TypeScript Academy course, upgrade to CoddyKit PRO.

What will I learn in “Secrets and Type Safety”?

Handle sensitive values without leaking them into types. You practise TypeScript Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start TypeScript Academy?

No prior experience is required. TypeScript Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Secrets and Type Safety” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this TypeScript Academy lesson?

Yes. Every TypeScript Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to TypeScript Academy