Perfect code can still leak: a key pushed to GitHub, a page sent over plain HTTP, a browser left to guess. Three habits close these doors: keep secrets out of code, serve everything over HTTPS, and send security headers.