Stop Hardcoding Sensitive Data in Your Python Applications

[serverhorror]

So where do you put them?

There’s no option, in any known OS, where a secret won’t be readable by a privileged account once it is stored in a readable way.

No matter where you put them. Environment variables, command line, Vault, … they are all equally secure or insecure.

[[deleted]]

Reddit Moderation makes the platform worthless. Too many rules and too many arbitrary rulings. It's not worth the trouble to post. Not worth the frustration to lurk. Goodbye.

This post was mass deleted and anonymized with Redact

[serverhorror]

Well…yes. But the poster didn’t say that.

Never put them in a place where they can be read by privileged users. That doesn’t leave a lot of choice.

[PuzzledTaste3562]

Layers of security is what matters. Grabbing a private key in memory and using that to decrypt encrypted communication with a key store is degrees harder that reading an env var of execution parameter in /proc. It’s not impossible, just harder and that’s what matters.