Issue 05-Fix our secrets in code

[ScotterMonk]

Security Concern: Sensitive Data Exposure in Config Files

Background

Our compliance team has identified a critical security vulnerability in our application. Credentials and other sensitive information are currently stored in plain text within our source code, specifically in the config.py file. This practice poses significant risks to our operations and violates OWASP security best practices.

Risks

1. Data Breach: Unauthorized access to our systems if source code is compromised.
2. Compliance Violations: Potential non-compliance with data protection regulations (e.g., GDPR, CCPA).
3. Insider Threats: Increased risk from internal bad actors with access to source code.
4. Reputational Damage: Loss of customer trust if a breach occurs due to this vulnerability.

Requirements

1. Remove all sensitive information (credentials, API keys, etc.) from config.py and any other source code files.
2. Implement a secure method for storing and accessing sensitive information, following OWASP best practices.
3. Update documentation to reflect new secure practices for handling sensitive data.
4. Conduct a thorough review of all code repositories to ensure no other instances of exposed sensitive data.

Acceptance Criteria

• No sensitive information visible in any code files when reviewing the repository.
• A secure method implemented for accessing necessary credentials in the application.
• Updated developer guidelines for handling sensitive information.
• Successful deployment of changes without breaking existing functionality.
• Passed security audit confirming the removal of all hardcoded sensitive data.

Priority

High - This issue poses an immediate security risk and should be addressed as soon as possible.

Additional Notes

Please consult with the security team for recommended best practices on securely storing and accessing sensitive information. Consider using environment variables, secure vaults, or other approved methods.

[ScotterMonk]

PR: https://github.com/ScotterMonk/scottswain/pull/8 SOLUTION

• Added python-dotenv
• Set up .env file in project root.
• Would have added pointer to this file into .gitignore but it's already there.
• Changed Config and TestingConfig classes in config.py so they now pull from that .env file.

RECOMMENDATIONS

• Add use of SECRET_KEY, which is currently unused.
• Add user authentication check to every API call response (routes).