Panduan Praktis Mengelola Env Vars dan Secrets dengan Claude Code

Tidak sengaja meng-commit API key ke GitHub dan langsung keringat dingin — setiap developer pernah mengalaminya. 90% kebocoran secret adalah human error. Integrasikan Claude Code dan Anda bisa menerapkan keamanan secara mekanis, mulai dari setup .env hingga deteksi, rotasi, dan respons insiden.

1. Otomatisasi Setup .env

Developer baru kesulitan mengumpulkan env vars. Generate dari .env.example.

claude -p "
Read .env.example and interactively create a .env for this project.

For each variable:
1. What it's for
2. Where to get it (with URLs)
3. Recommended local dev value
4. Required or optional

Confirm .env is gitignored before saving.
"

Mempercepat onboarding developer baru secara drastis.

2. Blokir Commit Tidak Sengaja via Pre-Commit

Tangkap secret di detik git commit dijalankan.

claude -p "
Create .husky/pre-commit.

Requirements:
- Check staged files for:
  - AWS access keys: AKIA[0-9A-Z]{16}
  - Stripe: sk_live_[0-9a-zA-Z]{24}
  - GitHub PAT: ghp_[0-9a-zA-Z]{36}
  - Generic API-key-looking strings
- Reject commit and show file/line on detection
- Allow // secrets-ignore comment for false positives

Also compare with trufflehog and gitleaks, and
recommend a team-friendly setup.
"

gitleaks adalah standar industri — dipadukan dengan Claude Code bisa memperbaiki temuan secara otomatis.

3. Audit Riwayat Commit yang Ada

Periksa apakah masih ada kebocoran lama yang tersisa.

claude -p "
Scan the entire commit history for secrets:

1. Run gitleaks detect --source . --no-git
2. Categorize findings (active / already revoked / false positive)
3. For active leaks, show immediate rotation steps
4. Git history purge steps (git filter-branch or BFG Repo Cleaner)

Output to docs/security/secret-audit.md (treat as confidential).
"

:::message alert Secret bocor = segera revoke dan rotasi

Walau Anda membersihkan history, asumsikan fork dan cache sudah menyimpannya. :::

4. Jaga .env.example Tetap Sinkron

Perbarui .env.example otomatis saat .env berubah.

claude -p "
Compare .env and .env.example:

1. Vars in .env but not .env.example → add with placeholders
2. Vars in .env.example but not .env → propose removal if obsolete
3. Improve comments (purpose docs)
4. Confirm secret values remain as placeholders

Save .env.example in a git-diff-reviewable state.
"

5. Migrasi Secret Produksi ke Secrets Manager

Pindahkan secret produksi dari .env ke AWS Secrets Manager / Cloudflare Secrets / Doppler.

claude -p "
Migrate 10 production secrets from .env to AWS Secrets Manager:

1. aws secretsmanager create-secret commands
2. Least-privilege IAM read policy
3. App-side fetch code (with caching)
4. Deploy procedure (cut over from .env)
5. Rollback plan

Output Terraform definitions too.
"

Kondisi akhir: tidak ada secret produksi yang tersimpan di kode atau repo.

6. Jadwalkan Rotasi Secret Berkala

Rotasi setiap 90 hari, otomatis.

claude -p "
Design a script to auto-rotate API keys for Stripe, OpenAI, Resend every 90 days:

1. Issue new keys via each service's API
2. Save to Secrets Manager / Cloudflare Secrets
3. Trigger deploy to pick up new keys
4. Revoke old keys
5. Append to docs/security/rotation-log.md

Provide a monthly GitHub Actions schedule YAML.
"

Rotasi 90 hari biasanya memang menjadi syarat compliance.

7. Playbook Insiden untuk Kebocoran

Siapkan agar tidak panik saat insiden terjadi.

claude -p "
Write docs/security/incident-playbook.md for:

Scenario: AWS access key accidentally committed to a public GitHub repo

0-15 min:
- Revoke key in AWS Console
- Make the repo private

15 min - 1 hour:
- Check CloudTrail for unauthorized use
- Remove key from git history (git filter-branch)
- Issue new key, register in Secrets Manager

1 hour+:
- Notify security team
- Decide on customer disclosure

Include exact commands and designated owners.
"

Tulis Aturan Keamanan di CLAUDE.md

Batasi perilaku Claude Code itu sendiri.

## Secret Handling Rules

### Forbidden
- Hardcoding .env values in source code
- Logging API keys (including console.log)
- Putting secrets in comments
- Putting secrets in README / docs

### Required
- Update .env.example whenever API keys change
- Register new external service keys in Secrets Manager
- Pre-commit secret scan must pass

### AI Instructions
- Always use process.env.XXX for key values in generated code
- Never copy .env contents elsewhere
- Route secret-related changes through human review

Ini mengurangi kemungkinan Claude Code tidak sengaja meng-hardcode key.

Anti-Pattern

❌ Membiarkan .env.example tertinggal

Anggota baru tak bisa menjalankan aplikasi, kacau. Jaga keduanya tetap sinkron.

❌ Berbagi API key via Slack / Zoom

Akan terus tersimpan selamanya di riwayat. Gunakan tool secret-sharing (1Password / Doppler).

❌ Men-log data sensitif

console.log(req.headers) membuka header Authorization. Masking secara agresif.

❌ Berasumsi “tak akan ada yang tahu”

Bot mendeteksi dan menyalahgunakan key dalam 5 detik. Anggap tiap commit sebagai publik.

Kesimpulan

• Setup .env secara interaktif
• Pre-commit mendeteksi kebocoran secret
• Audit commit historis
• Jaga .env.example tetap sinkron
• Migrasi secret produksi ke Secrets Manager
• Otomatisasi rotasi 90 hari
• Siapkan playbook insiden
• Batasi perilaku AI melalui CLAUDE.md

Manajemen secret adalah masalah sistemik. Claude Code memungkinkan Anda beralih dari pengecekan ad-hoc ke jaring pengaman yang mekanis.

Terkait: Security Audit / Web Security Headers / Panduan Hooks

Dokumentasi resmi: Anthropic Claude Code / gitleaks