Separate three kinds of configuration
Keep public website metadata, application runtime settings and provider secrets in separate layers. A value that is safe to publish should not share storage with credentials.
Fail configuration checks before traffic moves
Validate required variables, URL formats, writable private paths and adapter prerequisites during release checks. Missing critical configuration should stop the release, not appear later as a checkout failure.
Never package secrets into the website ZIP
Inject secrets through the production environment or a dedicated secret manager. Do not commit them, render them into HTML, place them in JavaScript, or include them in baseline files.
Record what changed and why
Configuration changes should have an owner, timestamp and rollback value. For sensitive settings, record the key name and outcome rather than the secret value itself.
Use these patterns to structure a Thonem project, then verify the exact routes, providers, secrets, queues and infrastructure of the deployed environment before changing production.