I see developers make a mistake that can ruin their entire month.

They are building a new Rails SaaS. They get their Stripe secret key, their OpenAI key, and their AWS credentials. To deploy the app, they create a file called .env.production on their laptop, paste the keys inside, and deploy.

Then, late on a Friday night, they accidentally type git add . and push that file to a public GitHub repository.

Within exactly 4 seconds, automated bots scrape those keys. By Saturday morning, hackers have spun up $50,000 worth of crypto-mining servers on their AWS account.

As a solo developer, you cannot afford this mistake. You need a system where your production secrets never touch a file that can be committed to Git.

With the release of Kamal 2 , managing secrets has been completely overhauled. You can now pull your API keys directly from your password manager during the deployment process.…