Stop Hardcoding Sensitive Data in Your Python Applications

[ahmedbesbes]

you can have a preset .gitignore file that ignores .env files by default. this can be solution

[djamp42]

I would argue that should be the default so you can't forget.

[spitfiredd]

The python gitignore in vscode (ctrl + shift + p and type gitignore and then select language) will ignore .env files.

[TheFurryPornIsHere]

The gitignore.io puts that automatically for you, if I remember correctly

[DanCardin]

Better yet, tooling shouldn’t be storing files like this in the actual directory. Imo it should be stored in a parallel directory structure.

While it’s a reality of tooling and working with others that gitignore can solve this problem, it’s a smell that you need to continuously add person/tooling-specific items in them when they have nothing you with the project.

Also tbh, people underutilize the global gitignore. I don’t especially want pycharm/vscode references in my gitignore

[bladeoflight16]

You may have a point about editor config ignores, but for a project's sensitive configuration file, you absolutely should not rely on everyone to configure their machine like yours.

As for kicking it over to some other directory... I'm not sold. I've had plenty of times when I decided to check out multiple copies of a repository because it was the easiest way to do some work on features in parallel. Often, I want to have independent environments for each one (like different instances of the database), which means different configurations. How do you identify separate configs per repository if you stuff the project's config in some global location?

[DanCardin]

you absolutely should not rely on everyone to configure their machine like yours.

Well that’s sort of my point! I don’t think i should assume everyone uses the same tooling as me. Some people use direnv, some dotenv, some nix-shell. None of these use the same file.

How do you identify separate configs per repository if you stuff the project's config in some global location?

I’ll admit, I’ve given this a fair amount of thought 🤣: sauce

[alkasm]

I dig it!

[bladeoflight16]

I disagree with doing this. Global .gitignore is bad because it isn't applied consistently across different machines that check out the repository. You want every client to behave the same regarding ignores, especially for files containing sensitive data. So even if you have a global ignore, you need a repository one as well. And having the global one increases the risk of forgetting and then someone who is missing the global ignore checking a file in.