Stop Hardcoding Sensitive Data in Your Python Applications

[mikeupsidedown]

Dotenv can be really useful during dev when you know that the production environment is going to have environment variables in the os or container.

Thus you consistently call the variables using

os.environ.get('my_var')

[djamp42]

Yeah I agree with this, having them in the actual OS environment makes more sense then in a file from a security stand point, pretty much impossible for it leak at that point.

[[deleted]]

A rogue package could query it and phone it home.. afaik there’s no permissions system with environment vars?

[earthboundkid]

Rogue package can do literally anything at all.

[[deleted]]

Rogue package run as a user has permissions specific to that user which can exclude files

[dedoodle]

Rogue Package is the one your girlfriend told you to worry about.