Hardcoded SendGrid API token in source codeSCT-1032

Using hardcoded SendGrid API tokens in source code can cause severe security issues as it can give unauthorized access to SendGrid resources, which can result in a data breach and financial loss. If an API token has been leaked, you can revoke your API token to mitigate the vulnerability.

Bad practice

import sendgrid

API_KEY = "HARDCODED_SENDGRID_API_TOKEN"
sg = sendgrid.SendGridAPIClient(api_key=API_KEY)

Recommended

import sendgrid
import os

API_KEY = os.getenv('SENDGRID_API_KEY')
sg = sendgrid.SendGridAPIClient(api_key=API_KEY)