Share config files without the credentials
Config files are where secrets live, and config bugs are exactly the kind of thing you need a second pair of eyes on. That tension is why the routine below exists: you keep the structure, the keys and the ordering, and replace only the values that would hurt.
The 60-second redaction pass
- Copy the file to a scratch copy. Never edit the original in place.
- Replace every value on a line whose key suggests a secret:
TOKEN,KEY,SECRET,PASSWORD,PASS,CREDENTIAL,DSN,CONNECTION. - Replace hostnames and IPs with placeholders, keeping the shape:
db.prod.internal→db.example.internal. - Check for secrets hiding in unusual places: URLs with basic auth, query strings with keys, comments left by a previous engineer.
- Paste, then read the paste once more on the page before sending the link.
Audit an .env file by key name
# list likely-secret lines in an env file (shows keys, not values)
grep -nE '^[A-Z0-9_]*(KEY|TOKEN|SECRET|PASSWORD|PASS|DSN|CREDENTIAL)[A-Z0-9_]*=' .env | cut -d= -f1What each format tends to leak
| File | Usual leak | Safe to share as |
|---|---|---|
| .env | Real values for every key | Keys with REDACTED values |
| docker-compose.yml | Registry creds, DB passwords in environment: | Structure plus ${VAR} references |
| nginx.conf | Upstream hostnames, TLS key paths, basic-auth file paths | Paths replaced with /etc/ssl/example.pem |
| SSH config | Real hostnames, usernames, identity file paths, jump hosts | Host aliases and User example |
| CI config | Tokens in env:, deploy targets, account ids | Secret names, never values |
| Terraform variables | Account ids, ARNs, default passwords | Variable names and types |
Why placeholders beat deletion
Deleting a line changes the file's structure, and the bug you are asking about may depend on the line you removed. Replace the value instead: DATABASE_URL=postgres://user:REDACTED@db.example.internal:5432/app still shows the scheme, the driver, the port and the database name — enough to spot a typo — while hiding the credential. Keep indentation and key order too; YAML and compose files are order-sensitive in ways that matter.
Settings for config pastes
- Unlisted. A config file has no business in a public feed.
- Expiry. A few days. Config reviews finish.
- Password. Add one for production configs and send it on another channel.
- Language. YAML, TOML/INI, Bash or plain text, matching the file so braces and keys are readable.
And if a real secret did get out — even briefly — rotate it. A link that existed for two minutes was still readable by anything that fetched it.
Frequently asked questions
Is it ever safe to paste a real .env file?
No. Replace values with placeholders. If the reader needs to reproduce the bug, give them the key names and the shape of each value, not the value.
Are pastes encrypted?
Traffic is encrypted with HTTPS, and the database is encrypted at rest by the provider, but the content is not end-to-end encrypted and the site can technically read it. Do not treat a paste as a vault.
Can I delete a config paste later?
If you created it while signed in, yes. Anonymous pastes cannot be deleted by their author, so use an expiry or burn-after-read for those.
What if I already pasted a production secret?
Rotate the credential first, then delete the paste. Rotation is the only step that actually revokes access; deleting the link just makes it harder to find.