# Key hygiene: the literal in the guide is not a pattern
Every framework guide needs to show where the key goes, so they write it
inline: `new Resend("re_xxxxxxxxx")`, `new Resend('re_xxxxxxxxx')`, or a key
constant in the Lambda handler. All three are placeholders.
## Checklist
- Read the key from the environment in every runtime: `process.env` in Node,
`os.environ` in Python, `env` bindings in Workers, function environment
variables in Lambda.
- Never commit a key. A literal that reaches version control must be treated as
compromised.
- Resend documents the leaked-key response in its knowledge base: know where
to rotate before you need it, not after.
- One key per environment. A development key and a production key mean a leaked
dev key is an incident, not a catastrophe.
- If a key ever appears in logs, error output, or a bundle, rotate it. The
scanner that matters is the one reading your repo, not the one reading your
drafts.