Keep Secrets Out of Your .env File

Wed, 10 Jun 2026 00:00:00 +0000

Recently there was a slew of supply chain attacks on several Python packages. One of them, named Shai-Hulud, was especially impressive because you only had to install the compromised package, no import needed. It then steals any credentials and secrets it can find on your machine, including ones in .env files.

My main question was: do people still keep secrets in environment variables? API keys just lying around in plain text .env files on your hard drive sound like a terrible idea. Especially when the alternative is so simple and elegant. This is why I’m sharing my favorite pattern for fetching secrets in Python: the secret resolver. It reads your secrets during application runtime from the secret provider of your choice, be it Azure Key Vault, KeePass, or 1Password.

Security on Don't Repeat Yourself

Keep Secrets Out of Your .env File