开源 API 应用安全

Question

I'm a bit new to building open source API applications. I've learned that it is the safest to hide your API keys from your source code and that one way to do this is by using environment variables. But one question keeps bugging me: how could an open source app be safe when any user can open the source code and figure out the API keys themselves? It might not be directly in the source code but you can just modify the code to get it, right?

Answer 1

the values of the environment variables is not stored in the source code, instead they are added to the OS environment and the application can read these values when it is running.

If a hacker gets access to the machine, then he can also access and read these variables, so that's why its important to secure and lock-down the server the application is running on.

So it is a fairly good approach as the secrets them self are not stored in the source code. They are set and created outside the application.