I'm building a Flask application that collects sensitive values such as API tokens and needs to retain them on a Linux system. My initial idea was to write the values to a credentials file under a protected directory and restrict the file and directory permissions so only the Flask service account could access them. Is that a reasonable design, and what security risks should I consider? The application may need to retrieve the original tokens later, so I'm also unsure whether hashing is appropriate. What would be a safer industry-standard approach?
3 Answers
File permissions are useful defense in depth, but they do not make plaintext secrets secure. Anyone who gains the Flask account’s privileges, compromises the application, reads a backup, or accesses the machine while it is running could obtain every token. If the application must recover the original values, hashing is not suitable; use authenticated encryption with a key stored separately, preferably through a secrets manager or a properly managed operating-system key service.
The right design depends on what the tokens are for. If you only need to verify a supplied secret, store a salted password hash using a password-hashing algorithm. If you must use the token later to call another service, store it encrypted and tightly restrict decryption access. In either case, define the threat model, limit the service account, protect backups, disable Flask debug mode in production, and rotate or revoke tokens when possible.
Use a dedicated secrets manager instead of designing your own credentials file. HashiCorp Vault or OpenBao can handle encryption, access policies, auditing, rotation, and controlled retrieval. Give the Flask service only the permissions it needs, authenticate the service securely, and avoid exposing secrets through logs, error messages, environment dumps, backups, or debugging tools.
OpenBao is another viable option if you want an open-source solution with a broad feature set. The important part is using a maintained secrets-management system rather than treating a local text file as the vault.
An encrypted disk helps if the machine is powered off or a drive is stolen, but it does not protect secrets from a compromised running application or an attacker who can use the Flask service account.