---
title: Keep secrets out of shipped code and logs
description: >-
  Keep access tokens, refresh tokens, your client secret, and every other
  credential on your server, out of anything you ship and anything you log.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/credentials-and-data/keep-secrets-out-of-shipped-code-and-logs
  md: >-
    https://shopify.dev/docs/apps/build/security/credentials-and-data/keep-secrets-out-of-shipped-code-and-logs.md
---

# Keep secrets out of shipped code and logs

Keep access tokens, refresh tokens, your client secret, and every other credential on your server, out of anything you ship and out of anything you log.

***

## Why

Anything in a theme or app bundle is public. Automated scanners continuously crawl published storefronts and public repositories for credential patterns, including secrets that were removed but are still in earlier commits. The usual places secrets turn up are Liquid templates, theme assets, JavaScript bundles, source maps, build-time environment variables inlined at compile time, HTML comments, and hidden form fields.

***

## How

Anything you put in shipped code should be harmless in an attacker's hands. On your server:

* Don't write access tokens, refresh tokens, or your client secret to logs, error reports, or analytics events.
* Don't send them to the browser in loader data, page globals, or API responses.
* Keep `.env` files and other files that hold secrets out of version control.

For more on handling your app's credentials, see [Manage your app credentials](https://shopify.dev/docs/apps/build/authentication-authorization/manage-credentials#secure-your-credentials). If a secret is exposed, then [revoke or rotate it immediately](https://shopify.dev/docs/apps/build/security/monitoring-and-response/respond-to-a-security-incident). Don't wait for confirmation that someone used it.

***