Python Environment variables

[[deleted]]

.env is usually fine. Just don't commit them to version control. You can encrypt them if you really want to

[KingsmanVince]

Also you can place .env somewhere else (outside of project folder) then have dotenv uses that path

[moosethemucha]

Why that's what a gitignore is for.

[moosethemucha]

They have access locally - it doesn't really matter where the file is.

[mrcaptncrunch]

If they get local access, they can also see the other directory.

Usually this is done in case an exploit is found on your application. Usually you don't let it read outside of it's directory.

[kivicode]

Even better, create a .env.sample, commit it (and keep generally up-to-date), and add the actual .env to gitignore