How to Protect Your Django Project's Secret Key
Tags: django, git, security, codenewbie
Published: 2022-07-01 13:45:00

I have been working on some Django tasks for a while. I mistakenly pushed my secret key to my public GitHub repository.😬 Yeah, rookie mistake! 🤷🏽‍♂️

I immediately received an email from GitGuardian informing me of the security risks involved.

![GitGuardian security risk notification email](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5ba0fxd58dl3ge0yua82.png)

I took some steps to avoid this problem in subsequent tasks and projects. Before I get to that, I will briefly highlight some requirements.
P.S. I use VSCode on a windows device. 😁

### Requirements

_**Use a .gitignore file.**_

- A .gitignore file tells git what files and directories to ignore. Git will automatically ignore any file or directory put in this file to protect sensitive information.

- Create .gitignore files at the root of your GitHub repository before you git-clone it to VSCode.

_**Create a virtual environment i.e. .env or .venv file.**_
```
#.env
py -3 -m venv .env
#.venv
py -3 -m venv .venv
```
- It is good practice to ignore your virtual environment by adding it into the .gitignore file, which you have included at the root of your repository.

### Steps

_**On your command line, install python-dotenv with the following code:**_
```
pip install python-dotenv
```
**_Go to your settings.py file and paste these two lines in your settings file:_**
```
from dotenv import load_dotenv
load_dotenv()
```
**_Copy your secret key from your settings.py file and paste it into the .env or .venv file you created:_**
```
SECRET_KEY=ui#1j%%f5mxdojzakk72+dvftl%4&y#31_a##16s6s(6pfxy-b
```

- Remove the spaces before and after the equal sign

- Remove the quotation marks

**_Next, in your settings.py file, you retrieve the secret key as follows:_**
```
SECRET_KEY = str(os.getenv('SECRET_KEY'))
```
![Tom Cat swallowing a key gif](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kdiyuw7qb8wjd46wemqw.gif)

**_You may need to add the import os function:_**
![Django import os function](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kbhscrufpl20czekp1ki.png)

**_Run the server to see if it works before you stage and commit:_**

```
python manage.py runserver
```

### Note

- **_I switched to Git Bash on VSCode. Some commands did not work as expected with other terminals._**
![Git Bash terminal on VSCode](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g8pr8zfcwfejkbnz3mmz.png)

- _**You may decide to try out any other terminal provided by VSCode:**_
![Terminals provided by VSCode](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9oxphdc591fukx0d34fj.png)

If you know other ways to solve this, kindly leave a comment. 👇🏽

Cheers! 🍻

### References

- [https://www.freecodecamp.org/news/gitignore-what-is-it-and-how-to-add-to-repo/](https://www.freecodecamp.org/news/gitignore-what-is-it-and-how-to-add-to-repo/)

- [https://code.visualstudio.com/docs/python/tutorial-django](https://code.visualstudio.com/docs/python/tutorial-django)

- [https://dev.to/vladyslavnua/how-to-protect-your-django-secret-and-oauth-keys-53fl](https://dev.to/vladyslavnua/how-to-protect-your-django-secret-and-oauth-keys-53fl)

### Cover Image Source

- [https://www.caplinked.com/wp-content/uploads/AdobeStock_209686850.jpeg](https://www.caplinked.com/wp-content/uploads/AdobeStock_209686850.jpeg)