Post #3852136
2026-07-16 06:22 UTC
Better than hard coded… Ideally we use tokens+fingerprint or something to avoid storing the creds directly (if possible), but putting them in environment variables is pretty common
It’s not the worst thing, it’s very convenient (so people won’t go around it) and usually not the weak point in security (although AI being able to easily see it is an interesting twist)
Replies (1)
-
@percent@infosec.pub 2026-07-16 15:30
Of course it’s better than hard coded, but still pretty bad to store production creds in plaintext — if at all. In the uncommon event that I need production creds, it’s a manual human chore by design. Normal development/experimentation should almost never connect to prod environments. That was generally a bad practice long before AI agents existed.