Stop Hardcoding Sensitive Data in Your Python Applications | by Ahmed Besbes | Towards Data Science

As a data scientist, I daily use Python to build applications that rely on credentials and sensitive settings.
Here are some examples of those, off the top of my head:
API keys to access third-party services
Passwords and credentials
Email addresses or personal data (name, age, social security number, etc.)
Debug flags
Hosts, URL, URI
and obviously, much more things.
Some of these settings are private by nature. Others are sensitive because they can provide insights into cyber-attacks or threats.
In this quick post, we’ll see how to address this problem using environment variables and a special file called .env .We’ll also learn how to interact with this file using the python-dotenv module and keep your sensitive data out of sight.
Without further ado, let’s have a look 🔍
Environment variables are variables that hold data that you don’t want to hardcode into your programs.They’re abstracted away and taken out of the code.
Their values live inside your operating system; they can either be built-in or set via custom applications.
Environment variables are made up of key/value pairs and you can use them to store different types of data.
Domain names
Execution modes (prod, dev, staging)
Credentials such as authentication keys, logins or passwords
Emails addresses, etc.
To access environment variables, you need to use the os module that provides utilities to read and write these values.
This seems like a handy way to keep sensitive data invisible, right?
Imagine that you need to use an API key in your code without divulging its value. All you need to do is load it from the environment variables:
api_key = os.gentenv("SECRET_API_KEY")  
But wait, I didn’t remember setting my API key as an environment variable. How do I do that?
There are two common ways:
From your terminal by typing:
export SECRET_API_KEY=XXXXXXXXXXXX
Or by adding the same line to your .zshrc , .bashrc or .bash_profile and sourcing it
If you need environment variables that’ll only be used in a specific project, I don’t recommend these two methods. In fact,
If you use your terminal, you need to remember to set your environment variables every time before running your program and this doesn’t seem right.
If you modify .zshrc or .bashrc every time you need to add a new environment variable, these files can quickly become cluttered with a lot of unnecessary information. If your environment variables are tied to very specific projects, it doesn’t make much sense to set them in a global scope where they can be accessed everywhere and at any point in time.
Hopefully, .env files seem to tackle this issue.
.env files are, first of all, text files that contain key/value pairs of all the environment variables required by your application.
They enable you to use environment variables without polluting the global environment namespace. In fact, each separate project can have its own .env file.
Here’s an example:
.env files are usually put at the root of a project. To access the values that are listed in them, you need to install the python-dotenv library.
pip install python-dotenv
Then, you only need to add two lines of code:
one to import the library:
from dotenv import load_dotenv
one to look for a .envfile and load environment variables from it
load_dotenv()
👉 When these two lines of code are executed, the environment variables are injected into the project runtime.When the project terminates, they’re flushed and they haven’t been added to the global namespace at any time.
The whole point of a .env file is to externalize sensitive data out of your codebase
Therefore you should never version this file or push it to Github.
You can keep it in your local development environment for testing and you should never share it with the public.
An easy way to avoid this unwanted situation is to add .envto your .gitignorefile:
.env
Python applications are not just a series of instructions and code. They are also coupled with data and configuration settings.
Most of the time, this config data is sensitive and needs to be accessed in a private manner.
Hopefully, environment variables and .envfiles handle this situation.
To get started with .env files here’s what you can do
Install the python-dotenv module using pip
Create the .env file with the appropriate environment variables of your project
Add it to the .gitignore file to prevent git from committing it
Load the the settings into your Python files using the python-dotenv module
Although the topic is not that complex to grasp, there is some great material I went through and learned one thing or two I didn’t know about environment variables and the use of .env files.
Here’s a curated list of some of these resources.
python-dotenv documentation
https://betterprogramming.pub/getting-rid-of-hardcoded-python-variables-with-the-dotenv-module-d0aff8ce0c80
https://dev.to/jakewitcher/using-env-files-for-environment-variables-in-python-applications-55a1
https://www.askpython.com/python/python-dotenv-module
https://www.youtube.com/watch?v=YdgIWTYQ69A&ab_channel=JonathanSoma
https://www.youtube.com/watch?v=rKiLd40HIjc&ab_channel=CodingEntrepreneurs
a nifty website to generate .gitignore files: https://www.toptal.com/developers/gitignore
Maybe you’ll learn something too 😉
If you’ve made it this far, I really thank you for your time.
That’ll be all for me today. Until next time for other programming tips👋