Use TLS, managed encryption, secret stores, data minimization, protected audit trails, and practiced incident procedures.

How to apply it

Keep secrets out of source, browser bundles, images, and logs. Record actor, action, target, timestamp, outcome, and correlation ID for sensitive events. Prepare containment, evidence preservation, communication, recovery, and post-incident review steps.

Worked example

If a token leaks, rotate and revoke it, inspect where it propagated, assess the exposure window, and document remediation.

Common mistakes to avoid

Treating public frontend variables as secret or logging request headers indiscriminately.

Practice task

Implement this concept in the capstone. Add one positive test, one negative or failure-path test, and a short note explaining the trade-off you chose.