Hardcoded FreshBooks access token in source codeSCT-1069

Leaking a FreshBooks access token in source code can cause severe security issues as it can give unauthorized access to FreshBooks resources, leading to a potential data breach and financial loss due to unauthorized utilization of FreshBooks resources.

If an access token has been leaked, it is recommended to regenerate it to mitigate the vulnerability.

Hardcoding the FreshBooks access token in the source code is not a recommended practice as it exposes the token to potential attackers who can extract it by reverse engineering the code or gaining unauthorized access to the codebase. Instead, it is advisable to use environment variables to store the access token securely. This ensures that the token is not hardcoded in the source code and is kept separate from the codebase. Using environment variables also makes it easier to manage the access token as it can be updated without modifying the source code.

Bad practice

import requests

FRESHBOOKS_ACCESS_TOKEN = "0123456789abcdef0123456789abcdef01234567"

response = requests.get(
    'https://api.freshbooks.com/v3/invoices',
    headers={'Authorization': 'Bearer ' + FRESHBOOKS_ACCESS_TOKEN}
)

Recommended

import requests
import os

FRESHBOOKS_ACCESS_TOKEN = os.getenv('FRESHBOOKS_ACCESS_TOKEN')

response = requests.get(
    'https://api.freshbooks.com/v3/invoices',
    headers={'Authorization': 'Bearer ' + FRESHBOOKS_ACCESS_TOKEN}
)