Secrets Management

Secrets Management

# NEVER hardcode secrets
# BAD:
DB_PASSWORD = "mysecretpassword123"
API_KEY = "sk-live-abc123"

# GOOD: Environment variables
import os
DB_PASSWORD = os.getenv("DB_PASSWORD")
if not DB_PASSWORD:
    raise ValueError("DB_PASSWORD not set")

# .env file (local dev only, in .gitignore)
from dotenv import load_dotenv
load_dotenv()

# HashiCorp Vault (production)
import hvac
client = hvac.Client(url="https://vault.example.com")
client.auth.kubernetes.login(role="myapp")
secret = client.secrets.kv.v2.read_secret_version(
    path="database/creds"
)["data"]["data"]

# AWS Secrets Manager
import boto3
sm  = boto3.client("secretsmanager")
val = sm.get_secret_value(SecretId="prod/myapp/db")["SecretString"]


# Pre-commit hook to prevent accidental commits
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets

# Scan git history for leaked secrets
truffleHog git file:///path/to/repo