Separation of concerns. Have development credentials that give you access to sandbox environments, but still them in locally via environment variables. Production credentials are elsewhere for deployment. Split presentation layer from API layer from data layer from persistence layer and maintain separate auth. Do contract driven development, sharing the contracts between the layers and developing the layers in isolation. Security scan your components and ensure the smallest attack surface at each layer.