py2exe executable containing private password

Question

In my setup, the py2exe bundles all the dependency modules into a zip and I can see them on the deployed machine. (*.pyo)

My script windows_app.py is specified in the setup.py as setup(windows = ["windows_app.py"] However I do not see windows_app.pyo on the deployed box anywhere (is this correct?). I do see "windows_app.exe" though which is expected.

My question here is, can I keep my private password in the windows_app.py (which goes into windows_app.exe) and assume it is a better place as the .pyo are easily decompilable.

Answer 1

An exe compiled by py2exe isn't compiled in the same sense as ac/c++ application is. When you run py2exe's setup command, it collects your dependencies and packages them together. Depending on the options supplied, it can create an archive file that contains the .py[odc] files that comprise your app, but they are still on the user system. They can be accessed, decompiled, inspected, or modified. What a user does with your code once they have it is out of your hands. You should not deploy sensitive information, passwords, private keys, or anything else that might cause damage in the "wrong" hands.