lesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least oncelesson 1 of 2 · .env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once.env, os.getenv, and the leak recovery you'll do at least once
Checkpoint
One last thing before we move on. pass this to mark the lesson done, or skip and keep moving. hop to the next when you're ready.
Final drill. Build a "ready to commit?" guard. Write
audit_files(files) that takes a list of dicts, each shaped
{"path": "<filename>", "content": "<text>"}, and returns a list
of strings — one warning per problem found. Rules, applied in order:
- If a file's
pathmatches.envor starts with.env.(but not.env.example), appendf"do not commit {path}"and STOP checking that file (don't run the second rule on env files). - Otherwise, if the file's
contentcontains the substring"sk-ant-"or"sk-test-", appendf"hardcoded key in {path}".
Files matching neither rule produce no warnings.
Then the script will exercise four files and print every warning, one per line.
Expected output:
do not commit .env
hardcoded key in src/bad.py