Hardcoded New Relic API key in source code SCT-1019

Leaking a New Relic API key in source code can cause severe security issues as it can give unauthorized access to New Relic resources, which can result in a data breach and financial loss due to unauthorized utilization of New Relic resources. New Relic has three kinds of API tokens - Browser API tokens, User API ID, and User API key.

If an API key has been leaked, you can revoke the key from the UI to mitigate the vulnerability.

It is recommended to use environment variables to store the API key. This ensures that the key is not hardcoded in the source code and is kept separate from the codebase. Using environment variables also makes it easier to manage the API key as it can be updated without modifying the source code. Additionally, it is recommended that access to the API key is restricted to only those who need it, by using the least privilege principle.

Bad practice

import requests

API_KEY = "YOUR_API_KEY"
URL = "https://api.newrelic.com/v2/applications.json"

headers = {
    "X-Api-Key": API_KEY,
    "Content-Type": "application/json"
}

response = requests.get(url=URL, headers=headers)

Recommended

import requests
import os

API_KEY = os.getenv('NEW_RELIC_API_KEY')
URL = "https://api.newrelic.com/v2/applications.json"

headers = {
    "X-Api-Key": API_KEY,
    "Content-Type": "application/json"
}

response = requests.get(url=URL, headers=headers)