zachwill/rottentomatoes — pull request #6 by alilja (2014-10-31 22:40:51+00:00)
Title: Preventing API keys from being exposed on Heroku apps

Ran into a problem where Django was throwing 403 errors from the RT API because Heroku was downloading its own copy of rottentomatoes from pypi — without the filled out rottentomatoes_api_key.py file. One way of solving this is using the ``RT(key)`` format, but this introduces a vulnerability by publicly exposing the user's API key in any public git repository.

My changes still allow for a api_key.py file, but if one is not found it instead uses an ``RT_KEY`` environment variable.

``os.environ.get`` was used to prevent crashing if the library is installed in a temporary directory without ``RT_KEY`` with a later check to see if a key was provided.