Rails credentials: Always use the bang version

Rails credentials are a way to store secrets in an encrypted YAML file. Usage is simple: each key in the credentials file becomes a method on Rails.application.credentials, returning the corresponding secret.

Copy# Credentials file
file_storage_secret: superstrongsecret

Copy# Somewhere in the application
FileStorage.secret = Rails.application.credentials.file_storage_secret

Since credentials usually are different between environments, you can easily forget to define them for another environment. If it is an API token, you'll quickly notice. However, if it is some kind of hashing salt, it might be missing without you noticing.

Suggestion

To be sure, always access credentials with a trailing exclamation mark:

CopyFileStorage.secret = Rails.application.credentials.file_storage_secret! # <- Here

This way, Rails will raise in case it is missing.

The same applies to the older "Rails secrets" stored in config/secrets.yml.