Simon Willison’s Weblog

Subscribe

Wednesday, 14th April 2021

Why you shouldn’t use ENV variables for secret data (via) I do this all the time, but this article provides a good set of reasons that secrets in environment variables are a bad pattern—even when you know there’s no multi-user access to the host you are deploying to. The biggest problem is that they often get captured by error handling scripts, which may not have the right code in place to redact them. This article suggests using Docker secrets instead, but I’d love to see a comprehensive write-up of other recommended patterns for this that go beyond applications running in Docker.

# 6:22 pm / security

2021 » April

MTWTFSS
   1234
567891011
12131415161718
19202122232425
2627282930