Think about the different APIs and databases your application works with. Every one of them requires either an API key or a database connection string that itself contains a password. How do you let your application access this sensitive information without storing it in source code or putting in other compromising locations? We have Glyph Lefkowitz on the show to share his security fable as well as just good advice for keeping secrets out of Python code. 
 
Links from the show 
 
<div>Glyph on Mastodon: <a href="https://mastodon.social/@glyph" target="_blank" rel="noopener">@glyph@mastodon.social</a> 
ShhGit: <a href="https://github.com/eth0izzle/shhgit" target="_blank" rel="noopener">github.com</a> 
Encrust: <a href="https://github.com/glyph/Encrust" target="_blank" rel="noopener">github.com</a> 
GitHub Security Alerts: <a href="https://docs.github.com/en/code-security/secret-scanning/managing-alerts-from-secret-scanning" target="_blank" rel="noopener">github.com</a> 
CIA Triad: <a href="https://www.fortinet.com/resources/cyberglossary/cia-triad" target="_blank" rel="noopener">fortinet.com</a> 
pinpal: <a href="https://github.com/glyph/pinpal/" target="_blank" rel="noopener">github.com</a> 
XKCD Authorization: <a href="https://xkcd.com/1200/" target="_blank" rel="noopener">xkcd.com</a> 
Tokenring: <a href="https://github.com/glyph/tokenring" target="_blank" rel="noopener">github.com</a> 
AWS Vault: <a href="https://github.com/99designs/aws-vault" target="_blank" rel="noopener">github.com</a> 
Gimme-AWS-creds: <a href="https://github.com/Nike-Inc/gimme-aws-creds" target="_blank" rel="noopener">github.com</a> 
Secrets in GitHub Actions: <a href="https://docs.github.com/en/actions/security-guides/encrypted-secrets" target="_blank" rel="noopener">github.com</a> 
Python Client for HashiCorp Vault: <a href="https://python-hvac.org/" target="_blank" rel="noopener">python-hvac.org</a> 
Pomodouroboros app: <a href="https://github.com/glyph/Pomodouroboros" target="_blank" rel="noopener">github.com</a> 
DateType: <a href="https://pypi.org/project/datetype/" target="_blank" rel="noopener">pypi.org</a> 
Haveibeenpwned: <a href="https://haveibeenpwned.com" target="_blank" rel="noopener">haveibeenpwned.com</a> 
PEP 541: <a href="https://peps.python.org/pep-0541/" target="_blank" rel="noopener">peps.python.org</a> 
Glyph's security talk at PyCon: <a href="https://us.pycon.org/2023/schedule/presentation/149/" target="_blank" rel="noopener">us.pycon.org</a> 
Watch this episode on YouTube: <a href="https://www.youtube.com/watch?v=Gey87cZXF3Q" target="_blank" rel="noopener">youtube.com</a> 
Episode transcripts: <a href="https://talkpython.fm/episodes/transcript/418/how-to-keep-a-secret-in-python-apps" target="_blank" rel="noopener">talkpython.fm</a> 
 
--- Stay in touch with us --- 
Subscribe to us on YouTube: <a href="https://talkpython.fm/youtube" target="_blank" rel="noopener">youtube.com</a> 
Follow Talk Python on Mastodon: <a href="https://fosstodon.org/web/@talkpython" target="_blank" rel="noopener">talkpython</a> 
Follow Michael on Mastodon: <a href="https://fosstodon.org/web/@mkennedy" target="_blank" rel="noopener">mkennedy</a> </div> 
Sponsors 
<a href='https://talkpython.fm/done-with-pycharm'>PyCharm</a>
<a href='https://talkpython.fm/compiler'>RedHat</a>
<a href='https://talkpython.fm/training'>Talk Python Training</a>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

#418: How To Keep A Secret in Python Apps

Talk Python To Me

AI Chapters

AI Insights

Reviews