5/5
## The .env Pledge We've seen that nearly half a billion dollars was lost in private key leaks in the past year. It's important to reiterate this. We need to be good at storing and securing private keys. There's a pledge called the .env pledge. It's a simple concept, but it's important to understand every single line. I'll read the pledge to you now. **The Pledge** I solemnly swear, that I will never place a private key or secret phrase or mnemonic in a .env file that is associated with real funds. I will only place private keys in a .env file that have ONLY testnet ETH, LINK, or other cryptocurrencies. When I'm testing and developing, I will use a different wallet than the one associated with my real funds. I am aware that if I forget a .gitignore and push my key/phrase up to GitHub even for a split-second, or show my key/phrase to the internet for a split-second, it should be considered compromised and I should move all my funds immediately. If I am unsure if my account has real funds in it, I will assume it has real funds in it. If I assume it has real funds in it, I will not use it for developing purposes. I am aware that even if I hit add account on my metamask (or other ETH wallet) I will get a new private key, but it will share the same secret phrase/mnemonic of the other accounts generated in that metamask (or other ETH wallet). **How to Take the Pledge** Please take a look at the ["THE .ENV PLEDGE"](envpledge.cyfrin.io). This began as a simple commitment on GitHub, but is now a permanent oath on-chain. Please read through the pledge and mint your own personalized soul-bound NFT to show people your commitment to safe practices. Stay safe!
We've seen that nearly half a billion dollars was lost in private key leaks in the past year. It's important to reiterate this. We need to be good at storing and securing private keys.
There's a pledge called the .env pledge. It's a simple concept, but it's important to understand every single line.
I'll read the pledge to you now.
The Pledge
I solemnly swear, that I will never place a private key or secret phrase or mnemonic in a .env file that is associated with real funds.
I will only place private keys in a .env file that have ONLY testnet ETH, LINK, or other cryptocurrencies.
When I'm testing and developing, I will use a different wallet than the one associated with my real funds.
I am aware that if I forget a .gitignore and push my key/phrase up to GitHub even for a split-second, or show my key/phrase to the internet for a split-second, it should be considered compromised and I should move all my funds immediately.
If I am unsure if my account has real funds in it, I will assume it has real funds in it. If I assume it has real funds in it, I will not use it for developing purposes.
I am aware that even if I hit add account on my metamask (or other ETH wallet) I will get a new private key, but it will share the same secret phrase/mnemonic of the other accounts generated in that metamask (or other ETH wallet).
How to Take the Pledge
Please take a look at the "THE .ENV PLEDGE". This began as a simple commitment on GitHub, but is now a permanent oath on-chain. Please read through the pledge and mint your own personalized soul-bound NFT to show people your commitment to safe practices. Stay safe!
A detailed guide to taking the .env pledge, a commitment to securing your private keys. The lesson covers the common mistakes developers make when storing private keys, the risks involved, and provides three secure methods of encrypting your private keys.
Previous lesson
Previous
Next lesson
Next
Course Overview
About the course
Python basics
Introduction to Web3.py
Introduction to Titanoboa
Introduction to Moccasin
How to create an ERC-20
How to test Python code and Vyper smart contract
How to deploy Vyper smart contracts on ZKsync using Moccasin
Smart Contract Auditor
$100,000 - $200,000 (avg. salary)
On-chain Data Analyst
$59,000 - $139,000 (avg. salary)
DeFi Developer
$75,000 - $200,000 (avg. salary)
Smart Contract Engineer
$100,000 - $150,000 (avg. salary)
Web3 developer
$60,000 - $150,000 (avg. salary)
Web3 Developer Relations
$85,000 - $125,000 (avg. salary)
Last updated on November 7, 2025
Duration: 2h 21min
Duration: 1h 51min
Duration: 59min
Duration: 2h 23min
Duration: 53min
Duration: 2h 25min
Duration: 29min
Duration: 1h 54min
Duration: 12min
Course Overview
About the course
Python basics
Introduction to Web3.py
Introduction to Titanoboa
Introduction to Moccasin
How to create an ERC-20
How to test Python code and Vyper smart contract
How to deploy Vyper smart contracts on ZKsync using Moccasin
Smart Contract Auditor
$100,000 - $200,000 (avg. salary)
On-chain Data Analyst
$59,000 - $139,000 (avg. salary)
DeFi Developer
$75,000 - $200,000 (avg. salary)
Smart Contract Engineer
$100,000 - $150,000 (avg. salary)
Web3 developer
$60,000 - $150,000 (avg. salary)
Web3 Developer Relations
$85,000 - $125,000 (avg. salary)
Last updated on November 7, 2025