Hardcoded Dynatrace API token in source codeSCT-1060

Leaking a Dynatrace API token in source code can pose serious security risks as it can allow unauthorized access to Dynatrace resources, leading to potential data breaches and financial losses. It is crucial to keep API tokens confidential and avoid hardcoding them in the source code.

If an API token has been compromised, it is recommended to immediately revoke the token and generate a new one from the Dynatrace portal to mitigate any potential vulnerabilities.

To address this issue, it is advisable to store API tokens securely, such as using environment variables. Storing API tokens in environment variables ensures that they are not hardcoded in the source code and are kept separate from the codebase. Additionally, using environment variables makes it easier to manage the tokens as they can be updated without modifying the source code.

Bad practice

import requests

DYNATRACE_API_TOKEN = "0123456789abcdef0123456789abcdef"

response = requests.get(
    'https://api.dynatrace.com/v1/some-resource',
    headers={'Authorization': f'Api-Token {DYNATRACE_API_TOKEN}'}
)

Recommended

import requests
import os

DYNATRACE_API_TOKEN = os.getenv('DYNATRACE_API_TOKEN')

response = requests.get(
    'https://api.dynatrace.com/v1/some-resource',
    headers={'Authorization': f'Api-Token {DYNATRACE_API_TOKEN}'}
)