Keeping secrets secret in Django

Speaker: Efe Öge

Secrets are part of every Django application, from SECRET_KEY to API keys, database credentials, and service tokens. But they are often handled inconsistently: hardcoded in settings, scattered across environment variables, or hidden behind tooling that adds more complexity than clarity.

This talk introduces a practical mental model for secrets in Django, explains common risks, including accidental leaks through LLM tools, and shows beginner-friendly patterns for keeping secrets secure without overengineering your setup.

Abstract

Secrets management often starts simple: a SECRET_KEY, a few API keys, maybe a .env file. Over time, that simplicity can turn into a confusing mix of environment variables, configuration patterns, local overrides, deployment settings, and external tools.

Not every Django application needs complex secrets infrastructure from day one. But every Django developer should understand what secrets are, where they appear, why they matter, and what can go wrong when they are handled carelessly.

In this talk, we will look at secrets in the context of a Django application. We will start with Django’s own SECRET_KEY and then move to common real-world examples such as database credentials, AWS keys, Stripe keys, signing tokens, and other service credentials.

We will discuss common mistakes, including committing secrets to source control, spreading them across too many places, relying blindly on environment variables, and making secrets difficult to reason about during development, deployment, and onboarding.

We will also cover a newer risk: how secrets can accidentally leak through LLM-assisted development workflows. Pasting settings, logs, stack traces, or configuration files into AI tools can expose sensitive values, so we will discuss safer habits and how to treat LLMs as untrusted environments when working with secrets.

Finally, we will explore a simpler approach to secrets management in Django: centralizing how secrets are accessed, keeping configuration intentional, and using lightweight patterns or tools such as django-root-secret where appropriate.

By the end of this talk, attendees will understand what counts as a secret in Django, why secrets need protection, the trade-offs of common approaches, and how to keep secrets secure while keeping their project setup maintainable.

About Efe

Efe Öge is a Software Engineer at Nebius. Outside work, he is building Yesglot, a Django-powered translation platform that opens translation pull requests for software projects.

Over the past ten years, Efe has built and operated production systems across blockchain, fintech, healthcare and developer tooling, including high-traffic APIs, large PostgreSQL workloads and cloud infrastructure. He is a founder of a new community DjangoNL, an open-source maintainer and a regular speaker at Django and Python conferences. He writes candidly about software engineering at efe.me.

Efe lives in Amsterdam. Away from work, he enjoys long runs, backgammon and photography. He is looking forward to Django Day Copenhagen and enjoying plenty of cardamom buns while he is there.