Last publication about what would be some Developer Tips, is in fact Tips for developer projects in their Final state. Those tips don't make life easier to developers, but to their projects, can do something really better. Just think with me.
You are a developer and you are finishing some project. Can be a site or a Android / iOS application. Even if you follow the recommendation for the code development, which is good to follow, you can make minor changes in what you do, giving to you, that small percentage of creativity, that make your product different from all others that use the same language and code recommendations.
You know that real Hackers, know as much as you or more and naturally, what you know as equal, is how the code works, while the logic behind is something that each one of you can use different approachs, there are some keys that can be totally different from what others will do with the default and common instructions that everyone do.
So Your final product can be about Cars and the server that will host your API code can have nothing there or some blank HTML page. Since you can use Linux you can setup the code VARIABLES for your tokens in Bash not in some .env file. You can setup a Reverse Proxy to create a Virtual Path for the Communication Node of Your API. Then, since you can be Free on Your creativity, you can setup for this example about cars, the Virtual Path in your Reverse Proxy settings as:
SuperCars.com/s/u/p/e/wheels/and/motors/api/
And your HTTP Application, can host nothing on that page.
Not even a index.html page. Nothing at all.
You can know a lot about what is Logic, but creativity is bigger than Logic ;)
If the attacker knows as much or more than you, he will start with the Default configurations USED by everyone that know how to code. For Web applications, you will start the obvious HTTP request on the / . Now the attacker can imagine: (how to talk with the API?)
If this information was useful, it have a price. Then You need to pay me :)
DEFCON Message: "I don't know anything about security,
but I Love Creativity.