For Indie Hackers

Your API keys are everywhere and you know it

Stripe key in a Slack DM. Twilio credentials in an email to a contractor. An Anthropic token somewhere in a GitHub comment you can't find anymore. Building multiple projects compounds this. Each one has its own set of secrets scattered across your tools.

It's not malicious. It's just what happens when you move fast and don't have a system.

A project per product

Each of your products gets its own project in doconvoy. The credentials for one product don't show up in another. If you bring a contractor onto Project A, they don't see Project B. The audit trail for each product is separate and clean.

It's a small structural change that makes a big difference when you're managing parallel codebases and changing contractors regularly.

Sharing tokens with contractors

The moment you hire a second contractor is the moment you need a process for sharing credentials. Email threads with API keys don't expire. Slack DMs get searched.

Send a one-time encrypted link instead. The contractor opens it, gets the token, and the link is gone. You see exactly when it was accessed. You can rotate and reshare without a mess.

Intake for collaborators

If you're accepting data from testers, early users, or integration partners, send them an intake request instead of asking them to email you configuration details. They fill in a structured form. You get it encrypted. No sensitive data in your inbox.

No account needed on their side, just a link.