API, Secrets & Supply Chain Security

Keys, rate limits, dependencies and CI/CD risk.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro Next lesson

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

8/8

1. 00:00API, Secrets & Supply Chain Security. Keys, rate limits, dependencies and CI/CD risk.
2. 00:05Never ship private keys to the browser - anything in client code is public.
3. 00:10Separate publishable keys from secret keys and rotate on exposure.
4. 00:15Rate limit and authenticate every API route, including webhooks.
5. 00:20Verify webhook signatures before trusting a payload.
6. 00:25Validate all input server-side with a schema, and allowlist fields to prevent mass assignment.
7. 00:30Audit dependencies, pin versions, and watch for typosquatted packages.
8. 00:35Note: Most modern breaches are not clever exploits - they are a leaked token in a repository, an unauthenticated internal endpoint, or an outdated dependency.

• Never ship private keys to the browser - anything in client code is public.
• Separate publishable keys from secret keys and rotate on exposure.
• Rate limit and authenticate every API route, including webhooks.
• Verify webhook signatures before trusting a payload.
• Validate all input server-side with a schema, and allowlist fields to prevent mass assignment.
• Audit dependencies, pin versions, and watch for typosquatted packages.