Enforcing Secure Coding Practices: Avoid Hardcoded Credentials and Use Environment Variables in GoFr Contributions

[ayushhhh2999]

1. The Contradiction
   In CONTRIBUTING.md the project clearly states:
   “Sensitive data (username, password, keys) should not be pushed. Always use environment variables.”
   However, many code examples and documentation files (like your Cassandra example) use hardcoded credentials, e.g.:
   Username: "cassandra",
   Password: "cassandra",

and in Docker commands: -e MONGO_INITDB_ROOT_USERNAME=user -e MONGO_INITDB_ROOT_PASSWORD=password

2. Why This Is a Problem
   Mixed Messaging: New contributors and users may be confused about what is acceptable. The docs say “don’t do this,” but the examples do it.
   Bad Habits: Developers often copy-paste code from docs. If the example uses hardcoded secrets, they might do the same in production, leading to real security risks.
   Potential for Accidental Leaks: If someone uses the same credentials in a real environment, they might accidentally commit real secrets.

3. Security Impact
   Propagation of Insecure Practices:
   If insecure patterns are shown in official docs, they can spread to many projects, increasing the risk of breaches.
   Reputation Risk:
   Open source projects are often judged by their documentation. Contradictory or insecure docs can harm the project’s reputation.

4. Suggestions
   Update All Examples:
   Replace hardcoded credentials with environment variable lookups, e.g.:
   Username: os.Getenv("CASSANDRA_USERNAME"),
   Password: os.Getenv("CASSANDRA_PASSWORD"),
   Add Security Warnings:
   Clearly state in every example that credentials are for demonstration only and must not be used in production.
   Align Docs and Policy:
   Ensure all documentation matches the security advice in CONTRIBUTING.md

5. Summary:
   This issue is about consistency and leadership in security practices. By fixing it, you help all users of the project avoid common security mistakes and make the project more professional and trustworthy.

[ayushhhh2999]

I am in gofr summer of code currently please assign this to me

[coolwednesday]

Hey @ayushhhh2999

Great issue you've pointed out—let’s address it in the following structured way:

1. Provide working Docker instances

   • Add the container setups required for the feature/service you're working on.

2. Include configuration in .env

   • Make sure all environment variables required by the containers are defined clearly.

3. Use app.Get() or app.GetOrDefault()

   • Access the configs in your code using these methods.
   • Reflect this consistently across all relevant examples and documentation.

4. Add a * note wherever applicable

   • Mention that it's good practice to manage configurations this way—via environment variables—to ensure portability and maintainability.

Can you also focus on making it look presentable. A lot of places the docs are a little messy. Please apply this consistently across all codebase examples and raise a single PR for the entire set of changes.

Let me know if you run into anything!

[ayushhhh2999]

@coolwednesday Thanks for the detailed breakdown! I'll implement this across all docs in a clean and consistent way.