TuCloud
Practical guidance for storing, separating, and operating application secrets on TuCloud while keeping sensitive infrastructure values protected.
Secrets are configuration, not source code
API keys, tokens, and database credentials change independently from application code. Keeping them outside the repository prevents sensitive values from entering commit history, review tools, and build output.
TuCloud associates secrets with the project and environment that uses them, preserving operational context without making the value visible where it does not belong.
Separate Preview from Production
Preview deployments often need limited credentials and isolated resources. Production requires a different trust boundary, so reusing the same values across both environments increases unnecessary risk.
Explicit separation also makes intent visible. A developer can understand which environment receives a variable without inspecting or copying the secret itself.
Expose purpose, protect value
Teams need enough metadata to operate safely. Update the external provider first when necessary, replace the value in the correct environment, deploy the consuming service, and revoke the previous credential after verification.
A predictable sequence limits downtime and prevents old credentials from remaining active simply because nobody knows which deployment still uses them.
Use Kuro without revealing credentials
Keeping that boundary explicit protects the infrastructure while preserving the speed of an AI-assisted workflow.
Good assistance depends on useful context, not unrestricted access. Questions should refer to variable names and environments rather than pasting credentials into the conversation.