Take secrets from the environment or a file instead of a flag

How to do it

Arguments show up in shell history, in process lists that other users on the machine can read, and in CI logs. Offer --token-file or a EXAMPLE_TOKEN variable instead. Store a saved sign-in as keep tokens in the system keychain says, or in a file only the user can read. Mask secrets in debug output, as keep private data out of logs and addresses says for logs.

Examples

Python example

import os, sys

def load_token(token_file: str | None) -> str:
    if token_file:
        with open(token_file, encoding="utf-8") as handle:
            return handle.read().strip()
    token = os.environ.get("EXAMPLE_TOKEN")
    if not token:
        print("Set EXAMPLE_TOKEN or pass --token-file.", file=sys.stderr)
        sys.exit(EXIT_USAGE)
    return token

Go example

func loadToken(tokenFile string) (string, error) {
	if tokenFile != "" {
		raw, err := os.ReadFile(tokenFile)
		return strings.TrimSpace(string(raw)), err
	}
	if token := os.Getenv("EXAMPLE_TOKEN"); token != "" {
		return token, nil
	}
	return "", errors.New("set EXAMPLE_TOKEN or pass --token-file")
}

How to check

The help text lists no flag such as --token, --password or --api-key that takes a value. A test runs every command with --debug and a known test token, and the token appears in neither output stream. A saved credentials file has mode 600.

Sources

• CWE-214, Invocation of Process Using Visible Sensitive Information
• OWASP Secrets Management Cheat Sheet

Related rules

• DSK-13 Keep tokens in the system keychain in Desktop apps, extensions and CLIs
• SEC-39 Keep private data out of logs and addresses in Adversarial testing