[Security Practice] pip-tools should not store API tokens/any credentials in generated lockfiles

[spstarr]

When generating hashed pypi dependencies with pip-tools, I notice it wants to write API tokens into those lock files.

This is not a good idea as a developer can write that to their code repository.

Shouldn't this be stripped from the lockfile?

Thanks, Shawn

[atugushev]

Hey @spstarr,

Thanks for the issue! Yes, the API tokens should be stripped. Could you provide an example of your lock file with masked sensitive data?

[atugushev]

@chrysle FYI removed the hashes label since it's related to --generate-hashes functionality.