Node.js: What you might be tempted to do

This documentation is part of the Handle secrets guide. View the full guide here: How to handle secrets with Node.js.

👋 Welcome to the Stackhero documentation!

Stackhero delivers a ready-to-use Node.js cloud environment designed to help you move faster:

• Deploy to production in seconds with a simple git push. No extra tooling or manual setup is required.
• Bring your own domain and benefit from automatic HTTPS certificates, keeping your application secure without extra configuration.
• Automatic backups, one-click updates, and predictable pricing help you focus on shipping features, and Stackhero manages the infrastructure for you.
• Built on private, dedicated infrastructure for consistent performance and strong security.

Save time and reduce operational overhead: you can have your application running on Stackhero's Node.js cloud hosting in just a few minutes.

At first, you might consider writing your credentials directly in your code, like this:

// Connecting to a PostgreSQL database
const pg = new Client({
  host: '<XXXXXX>.stackhero-network.com',
  user: 'admin',
  password: 'myPassword',
  database: 'admin'
});

However, this approach is not secure. This is because your secrets could easily end up in your Git repository, making them visible to anyone with access. Even if you think only you have access, it is a bit like leaving a Post-it note with your passwords on your monitor and hoping nobody else notices. This can eventually lead to serious security issues.

In addition, hard-coding secrets makes it difficult to manage different environments, such as development and production, smoothly.