不要将机密写入代码

WiFi passwords, API tokens, and private keys are all secrets. Anything that grants access must never sit in plain sight inside your sketch. 🔑

Flash memory can be read back over the wire. A plaintext key in your code is one chip dump away from being copied by anyone.

Commit a secret once and it lives in your history forever. Even after you delete it, the old commit still holds the exposed key.

Put credentials in a small file like secrets.h kept out of version control. This secrets header keeps keys off GitHub while your sketch stays shareable.

Add your secrets file to .gitignore so it can never be committed by accident. This single line prevents most real-world key leaks.

Instead of baking keys in, enter them once when the device first boots. Provisioning via a config page keeps secrets off your source entirely.

The ESP32 offers NVS, a key-value store in flash for runtime secrets. You write the token once and read it back on every boot.

Give each unit its own credentials, never a shared master key. With per-device keys, one stolen device can be revoked without touching the rest.

Plan to change keys on a schedule and kill leaked ones fast. Rotation limits how long any single stolen secret stays useful.

Give each token only the access it truly needs. Least privilege means a leaked device key can read its own topic, not your whole account.

Tools can catch a key before it reaches a remote repo. A secret scanner in your workflow blocks accidental leaks before they happen.

One of these keeps a key off your public repo.

Never bake secrets into code. Use a gitignored header, provision at setup, store in NVS, and keep per-device keys you can rotate. 🔐