Published on: 2026-06-06
Reading time: 8 min
Tags: #security #python #audit #devops
Over 3 months, I developed and audited 6 Python projects (3 bots + 3 libraries): a FastAPI + Telegram Bot + LLM integration system. I discovered 25 security/code issues and fixed 23 immediately.
Problem: Anthropic, Supabase, and Telegram API keys committed in .env
file
ANTHROPIC_API_KEY=sk-ant-api03-xxxxxxxxxx
SUPABASE_KEY=sb_publishable_xxxxxxxxxx
Risk: Anyone can access previous commits and steal API keys → resource abuse, data breach
Solution:
bfg --delete-files ".env" --no-blob-protection .
git rm --cached .env
echo ".env" >> .gitignore
Problem: verify=False
used in 10 places
response = requests.get(url, verify=False)
response = requests.get(url, verify=True) # default
Impact: HTTPS man-in-the-middle attacks possible → sensitive data exposed
Problem: except Exception
silencing all errors (114 instances)
try:
result = await db_select("contests")
except Exception:
print("failed") # What error? Unknown.
try:
result = await db_select("contests")
except requests.HTTPError as e:
logger.error(f"DB error: {e}", exc_info=True)
raise
Impact: Production incidents hard to debug → increased MTTR
__init__.py
Files
Problem: llm-router, supabase-async, telegram-agent had empty __init__.py
from llm_router import LLMRouter
__version__ = "0.1.0"
__all__ = ["LLMRouter"]
Impact: Import failures after pip install
DB operations in ai-insight-curator's processor.py were outside try block → exceptions unhandled
/contests?status=invalid&limit=999
accepted without checks| Metric | Value | |---|---| | New commits | 15 | | Files modified | 22 | | Code deleted | 347 lines | | Code added | 200 lines | | Tests passed | 91/91 files ✅ |
.env
to .gitignore
before first commit>=
)HTTPError
, ValueError
— never bare Exception
Urgent (24 hours):
High (1 week):
Exception
catches with specific typesMedium (2 weeks):
Ongoing:
In 3 months: 23 issues found and fixed.
If we'd done security right from day one:
The most important step: Start now. Every fix prevents future incidents.