In Python I load database passwords from environment variables. How does EK9 handle credentials and secrets?

← Security and Sanitization · Ref: Q1016

EK9 has the Sensitive type for secrets. Values wrapped in Sensitive are automatically redacted in logs, string output, and error messages.

Python:

  password = os.environ['DB_PASSWORD']    # Just a plain string — could be logged accidentally
  print(f'Connecting with {password}')     # OOPS — password in logs

EK9:

  dbPassword <- env.sensitiveGet("DB_PASSWORD")   returns Sensitive type
  stdout.println($dbPassword)                     prints ***REDACTED***

The Sensitive type wraps the value. When you convert to String with $, it shows ***REDACTED***. To access the actual value, you need the Privileged trait — and the compiler tracks which classes have it.

FOR CONFIGURATION (non-secret):

  dbHost <- env.get("DB_HOST")              returns plain String
  dbPort <- env.get("DB_PORT")              returns plain String

FOR SECRETS:

  dbPassword <- env.sensitiveGet("DB_PASSWORD")   returns Sensitive
  apiKey <- env.sensitiveGet("API_KEY")            returns Sensitive

The compiler prevents you from accidentally using sensitiveGet() values as plain strings — they stay wrapped in Sensitive until explicitly revealed by a Privileged class.

Example

defines module qa.security.sensitivecredentials

  defines program

    CredentialsDemo()
      stdout <- Stdout()

      // Non-secret configuration: use env.get()
      appName <- "MyService"
      stdout.println(`App: ${appName}`)

      // In production, secrets use env.sensitiveGet()
      // Only classes with 'trait of Privileged' can call reveal()
      stdout.println("Secrets are protected by the Sensitive type")
Other ways to ask this
  • How do I safely handle passwords and API keys in EK9?
  • What is the EK9 approach to managing secrets and credentials?
  • How does EK9 prevent accidental credential exposure?

Coming from another language?

Python developers: os.environ values are plain strings. EK9 separates config (env.get) from secrets (env.sensitiveGet). Secrets are compile-time protected against accidental exposure.

Keywords: sensitive, environment, secret, api key, redacted, password, credential