How to protect your secrets from accidental exposure by tracebacks and logs?


Protect your secrets from accidental exposure by storing them in pydantic.SecretStr objects

When you have to deal with secrets like authorization credentials and passwords you want to make sure that those values are not accidentally exposed in error messages, tracebacks, or logs. One easy way to improve protection of sensitive values is to use SecretStr from pydantic to store these values.  SecreStr is formatted as "**********". That means when we call print() or str() on a SecretStr object no sensitive information will be exposed. To access the value of a SecreStr object we call .get_secret_value() and since this only needs to happen when we hand the secrets other to perform authentication or login we reduce the chances of exposure.


Github gist with code

dependencies: python3.9pydantic==1.9.2

Comments