Security

SECURITY.md

Security Guidelines

Protecting Your Credentials

Never Commit Sensitive Data

CRITICAL: Never commit your actual credentials to version control. This includes:

.env files with real API keys or passwords
Any files containing SMTP credentials
API keys or tokens
Personal email addresses used in testing

What's Protected

The .gitignore file in this project is configured to exclude:

.env
.env.local
.env.*.local
__pycache__/
*.pyc
venv/

Before Publishing or Committing

Verify .gitignore is working:
```
git status
```
Your .env files should NOT appear in the list
Check for hardcoded credentials:
```
grep -r "kms_\|ak_\|sk_" --include="*.py" .
```
This should only return placeholder values in .env.example files
Use environment variables: All examples use os.getenv('VARIABLE_NAME') - never hardcode credentials

Safe Configuration Files

The .env.example files contain placeholder values only:

API_KEY=kms_xxxx
SMTP_USER=xxxxx
SMTP_PASSWORD=xxxxx

These are safe to commit and help users understand required configuration.

If You Accidentally Commit Credentials

Immediately revoke the exposed credentials in your Keplers.email dashboard
Remove them from git history (use tools like git-filter-repo)
Generate new credentials
Never just delete the file - git history retains it

Reporting Security Issues

If you discover a security vulnerability in these examples, please report it by:

Opening a GitHub issue (for non-sensitive issues)
Contacting the repository maintainer directly (for sensitive issues)

Best Practices

✅ Use .env files for local development
✅ Use environment variables in production
✅ Keep credentials in secure vaults (1Password, AWS Secrets Manager, etc.)
✅ Rotate credentials regularly
✅ Use virtual environments to isolate dependencies
❌ Never share credentials in chat, email, or screenshots
❌ Never commit .env files
❌ Never hardcode credentials in source code

There aren’t any published security advisories