Production-ready from day one.

Never commit secrets to source control

The generated project wires two named connection strings: LocalDb for development and ProdDb for production. Neither should ever appear in appsettings.json or any file tracked by git.

Development: user secrets

Use dotnet user-secrets to store your local connection string outside the project directory, where git cannot reach it regardless of .gitignore configuration.

dotnet user-secrets init
dotnet user-secrets set "ConnectionStrings:LocalDb" "Server=(localdb)\mssqllocaldb;Database=MyProject;Trusted_Connection=true;"

Production: environment variables

In production (Azure App Service, Docker, GitHub Actions), inject secrets as environment variables using the double-underscore convention that maps to nested configuration keys:

ConnectionStrings__ProdDb=Server=prod-server;Database=MyProject;...

What belongs in appsettings.json

Only non-sensitive, environment-agnostic configuration should be committed. Safe values include:

{
  "Database": {
    "Provider": "SqlServer"
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}

CI/CD pipelines

Store secrets as GitHub Actions secrets or pipeline variables and inject them at build time as environment variables. Never bake them into the image or pass them as build arguments.