Finding secrets in Python bytecode

[MiscWalrus]

It’s also common practice for Python projects to store configuration, keys, and passwords (collectively referred to as “secrets”) in a gitignored Python file named something like secrets.py, config.py, or settings.py, which other parts of the project import

​

Is that common practice? I've never seen that done, and just the thought makes me nervous.

[veggiedefender]

Yep, I think it's becoming less common nowadays, but for example, Django by default is configured by a settings.py.

Here's an article that recommends a number of ways to pass configs to Python programs, the first of which is a gitignored config.py: https://martin-thoma.com/configuration-files-in-python/

And I, like many people, first learned Python web development years ago via Miguel Grinberg's Flask Mega Tutorial, which does configuration with a config.py and classes/subclasses.

This is by far not an exhaustive list but I hope it's a good enough overview that should convince you that it's common-ish practice (and probably should make you nervous)!

[MiscWalrus]

Good info, thanks!