Where should an application's database password or API keys be kept?
Options
- Hardcoded in the source code of the application
- In environment variables or a secret manager (Correct option)
- In a comment inside the README of the project
- In the frontend JavaScript bundle of the site
Answer
In environment variables or a secret manager, never committed to git
Why
Anything in the code ends up in git history, on every developer's laptop and possibly in public. Anything in frontend code is visible to every visitor.
Load secrets at runtime from environment variables (os.environ["DB_PASSWORD"]) or a secret manager (AWS Secrets Manager, Vault).
Add .env files to .gitignore.
Remember
Secrets live outside the code: env vars or a secret manager.