# BAD — visible in ps aux and shell history
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/data
npx some-cli --api-key "$STRIPE_KEY" deploy
docker build --build-arg SECRET_KEY="$SECRET_KEY" .

# GOOD — reference the env var; the shell expands it but it never touches args
# curl reads Authorization from env via a config file
curl -K <(echo "header = \"Authorization: Bearer $TOKEN\"") https://api.example.com/data

# Or use a tool that reads directly from env
STRIPE_KEY="$STRIPE_KEY" npx some-cli deploy

# BAD — emits the secret value
echo "Using key: $ANTHROPIC_API_KEY"
echo $STRIPE_SECRET_KEY
printenv AWS_SECRET_ACCESS_KEY

# GOOD — check presence without revealing value
if [ -z "$ANTHROPIC_API_KEY" ]; then
  echo "ANTHROPIC_API_KEY is not set" >&2
  exit 1
fi
echo "ANTHROPIC_API_KEY is set (${#ANTHROPIC_API_KEY} chars)"

# Check length only — confirms the var exists and is non-trivial
echo "Key length: $(printenv ANTHROPIC_API_KEY | wc -c) chars"

# BAD — password in args
docker login --username user --password "$DOCKER_PASSWORD" registry.example.com
gh auth login --with-token "$GH_TOKEN"

# GOOD — pipe through stdin
echo "$DOCKER_PASSWORD" | docker login --username user --password-stdin registry.example.com
echo "$GH_TOKEN" | gh auth login --with-token

# GOOD — process substitution (bash/zsh only)
git clone https://user:$(cat <(printenv GIT_PASSWORD))@github.com/org/repo.git

# Prevent the current session's commands from being saved
unset HISTFILE

# Or prefix commands with a space (requires HISTCONTROL=ignorespace in bashrc)
 export SECRET_KEY="actual-value-here"   # leading space — not saved to history

# For a block of sensitive operations
(
  unset HISTFILE
  # ... sensitive commands here ...
)

# BAD — world-readable temp file, never cleaned up
echo "$PRIVATE_KEY" > /tmp/key.pem
some-tool --key /tmp/key.pem

# GOOD — restricted permissions, guaranteed cleanup
KEY_FILE=$(mktemp)
chmod 600 "$KEY_FILE"
trap "rm -f '$KEY_FILE'" EXIT
echo "$PRIVATE_KEY" > "$KEY_FILE"
some-tool --key "$KEY_FILE"
# trap fires on exit — file always removed

# BAD — logs the token
echo "Calling API with token: $API_TOKEN"
curl -v -H "Authorization: Bearer $API_TOKEN" https://api.example.com

# GOOD — log the outcome
echo "Calling API..." >&2
RESPONSE=$(curl -s -o /dev/stdout -w "%{http_code}" \
  -H "Authorization: Bearer $API_TOKEN" https://api.example.com)
STATUS="${RESPONSE: -3}"
BODY="${RESPONSE:0:${#RESPONSE}-3}"
echo "API response: HTTP $STATUS"

# BAD — hardcoded in script (never do this)
STRIPE_KEY="sk_live_<your-key-here>"
curl -u "$STRIPE_KEY:" https://api.stripe.com/v1/charges

# GOOD — always from environment
: "${STRIPE_SECRET_KEY:?STRIPE_SECRET_KEY must be set}"
curl -u "$STRIPE_SECRET_KEY:" https://api.stripe.com/v1/charges

# Use a netrc file (chmod 600) instead of --user flag
echo "machine api.example.com login token password $API_KEY" > ~/.netrc
chmod 600 ~/.netrc
curl --netrc https://api.example.com/endpoint

# Use --config with process substitution to avoid the header in args
curl -K <(echo "header = \"Authorization: Bearer $TOKEN\"") https://api.example.com

# Use a credential helper — never embed tokens in remote URLs
git config --global credential.helper store   # or 'osxkeychain' / 'manager'
echo "https://token:$GH_TOKEN@github.com" | git credential approve

# For CI: use GIT_ASKPASS
export GIT_ASKPASS=echo
export GIT_PASSWORD="$GH_TOKEN"
git clone https://user@github.com/org/repo.git

# Pass secrets at runtime, not build time
# BAD — baked into the image layer
docker build --build-arg API_KEY="$API_KEY" .

# GOOD — mount a secret at build time (BuildKit, never in image layers)
DOCKER_BUILDKIT=1 docker build --secret id=api_key,env=API_KEY .
# In Dockerfile: RUN --mount=type=secret,id=api_key ...

# GOOD — inject at runtime only
docker run -e API_KEY="$API_KEY" myimage

# Secrets are masked in logs automatically when referenced via secrets context
- name: Call API
  env:
    API_KEY: ${{ secrets.API_KEY }}
  run: |
    # $API_KEY is masked in output — GitHub replaces it with ***
    curl -H "Authorization: Bearer $API_KEY" https://api.example.com

# Add extra masking for derived values
- run: |
    DERIVED="${API_KEY:0:8}-suffix"
    echo "::add-mask::$DERIVED"
    echo "Derived prefix set"

// Node — read from process.env, never log the value
const apiKey = process.env.ANTHROPIC_API_KEY
if (!apiKey) throw new Error('ANTHROPIC_API_KEY is required')
console.log(`API key configured (${apiKey.length} chars)`)  // length only

# Python — use os.environ, validate early, never print
import os
api_key = os.environ["ANTHROPIC_API_KEY"]  # raises KeyError if missing
print(f"API key configured ({len(api_key)} chars)")  # length only