saadmk11 / django-todo Goto Github PK

Hello! For my project I'm integrating Firebase firestore with Django REST framework. And I was searching for universal way to handle relation with database from my Django code. And your firebase_client is very nice solution.

But I notice one potential security issue: if you use decouple to pull information from your .env file and over seetings.py and FIREBASE_ADMIN_CERT = config("FIREBASE_ADMIN_CERT") to be present in rest of project. What I notice is when I send GET or POST from my Python test client to Django server with some data validation and serialization in place., if error is returned, for example in my case:
"document": doc_item["document"], UnboundLocalError: local variable 'doc_item' referenced before assignment"

what I will get on side of client is full seetings.py file with private keys from FIREBASE_ADMIN_CERT fully exposed.

I was just curious if Im doing something wrong or this is security issue in proposed code?

Thanks!
Best regards
Ilija