Move hardcoded Gmail app password out of reminders.py into env #2

New Issue

tonym · 2026-06-06T19:58:10Z

tonym commented

2026-06-06 19:58:10 +00:00

Severity: critical
Category: security
Location: reminders.py:11-12

Problem

APP_PASSWORD is set to a live Gmail app password hardcoded in source (value redacted here) — it is now committed in git history on Gitea and readable by anyone with repo access.

Suggested fix

Rotate the password immediately, then read it from os.environ["GMAIL_APP_PASSWORD"]. Document in .env.example.

Filed by automated code review.

**Severity:** critical **Category:** security **Location:** `reminders.py:11-12` ### Problem `APP_PASSWORD` is set to a live Gmail app password hardcoded in source (value redacted here) — it is now committed in git history on Gitea and readable by anyone with repo access. ### Suggested fix Rotate the password immediately, then read it from `os.environ["GMAIL_APP_PASSWORD"]`. Document in .env.example. _Filed by automated code review._

tonym added the

security

severity:critical

labels 2026-06-06 19:58:10 +00:00

tonym referenced this issue from a commit

2026-06-06 21:38:22 +00:00

Add in-app Settings page for secrets; move Gmail creds out of source

tonym closed this issue

2026-06-06 21:38:23 +00:00

Sign in to join this conversation.