Question: I have built an application and added my SMTP credentials like this (in the server code block):

```
Meteor.startup(function () {
    smtp = {
      username: 'username@emails.com',   
      password: 'lkajflkadjakdlfj',   
      server:   'smtp.emails.com',  
      port: 587
    }

    process.env.MAIL_URL = 'smtp://' + encodeURIComponent(smtp.username) + ':' + encodeURIComponent(smtp.password) + '@' + encodeURIComponent(smtp.server) + ':' + smtp.port;
});

```

This works, and is sending just fine. But my credentials are available to anyone just be reading the source code of my deployed application.

Is there somewhere else I should be storing these credentials? Or another method entirely of setting this up?

Answer: 
Try to avoid hardcoding environment variables in your code in general, there are several other options available to you.

You could use `Meteor.settings` to store your private credentials :

`private/settings.json`

```
{
  "MAIL_URL": "smtp://smtp://postmaster%40mg.domain.com:password@smtp.mailgun.org:587"
}

```

`server/config.js`

```
process.env.MAIL_URL = Meteor.settings.MAIL_URL;

```

Don't forget to feed your app with meteor settings :

Local development workflow :

```
meteor --settings private/settings.json

```

Deploying to Meteor servers :

```
meteor deploy myapp.meteor.com --settings private/settings.json

```

Another option is to use `mup` ([Meteor Up](https://github.com/arunoda/meteor-up)) which provides a config file named mup.json where you can store your credentials as env variable, which is very handy.

`mup.json`

```
"env": {
  "MAIL_URL": "..."
}

```

Last but not least, if you're using version control, don't forget to `.gitignore` your settings !

`.gitignore`

```
private/settings.json
mup.json

```
From the Meteor documentation (<http://docs.meteor.com/#/full/structuringyourapp>):

> 
> Any directory named server is not loaded on the client. Similar to
>  wrapping your code in if (Meteor.isServer) { ... }, except the client
>  never even receives the code. Any sensitive code that you don't want
>  served to the client, such as code containing passwords or
>  authentication mechanisms, should be kept in the server directory.
> 
> 
>