Hardcoded Brevo (Formerly Sendinblue) API token in source codeSCT-1031

A hardcoded Brevo (formerly Sendinblue) API token in source code can cause severe security issues as it can give unauthorized access to Brevo resources, which can result in a data breach and financial loss. If an API token has been leaked, you can revoke your API token to mitigate the vulnerability.

Bad practice

import requests

API_TOKEN = "HARDCODED_APP_TOKEN"
headers = {
    'api-key': API_TOKEN,
    'Content-Type': 'application/json'
}

def send_email(data):
    response = requests.post(
        url="https://api.sendinblue.com/v3/smtp/email",
        headers=headers,
        json=data
    )
    return response.json()

Recommended

import requests
import os

API_TOKEN = os.getenv('BREVO_API_TOKEN')
headers = {
    'api-key': API_TOKEN,
    'Content-Type': 'application/json'
}

def send_email(data):
    response = requests.post(
        url="https://api.sendinblue.com/v3/smtp/email",
        headers=headers,
        json=data
    )
    return response.json()