Skip to main content

Environment Variable Leaks: The Danger of .env and .pypirc

The .env Anti-Pattern​

The "Twelve-Factor App" methodology taught us to store config in the environment. In local development, we use .env files to simulate this.

The problem arises when .env is treated as a configuration file rather than a secrets file.

  • "I'll just commit it so the team can run the project."
  • "I forgot to add it to .gitignore."

A committed .env file usually exposes every single secret required to run your application: Database URLs, API keys, and Debug flags.

The .pypirc Threat (Supply Chain)​

A less common but more critical leak is the .pypirc file. This file stores your credentials for uploading packages to PyPI (Python Package Index).

[pypi]
username = __token__
password = pypi-AgEIcHlwaS5vcmc...

If you accidentally commit this file to a public repository, an attacker can:

  1. Steal your publisher identity.
  2. Push a malicious update to your popular Python package (e.g., v1.0.1 with a backdoor).
  3. Infect every user who runs pip install your-package.

This is how Supply Chain Attacks happen.

Preventing Configuration Leaks​

  1. Global Gitignore: Configure a global .gitignore on your machine that excludes .env and .pypirc by default.
  2. Use Templates: Commit .env.example with dummy values, never real secrets.
  3. Pre-commit Checks:

Veritensor treats these files as critical threats. It scans filenames and contents to ensure that:

  • No .env files containing actual values are committed.
  • No .pypirc or .git-credentials files ever enter the repository.
# Run a check before pushing
veritensor scan .

Keeping configuration separate from code is the first rule of secure engineering.