1/5
## The .env Pledge We've seen that nearly half a billion dollars was lost in private key leaks in the past year. It's important to reiterate this. We need to be good at storing and securing private keys. There's a pledge called the .env pledge. It's a simple concept, but it's important to understand every single line. I'll read the pledge to you now. **The Pledge** I solemnly swear, that I will never place a private key or secret phrase or mnemonic in a .env file that is associated with real funds. I will only place private keys in a .env file that have ONLY testnet ETH, LINK, or other cryptocurrencies. When I'm testing and developing, I will use a different wallet than the one associated with my real funds. I am aware that if I forget a .gitignore and push my key/phrase up to GitHub even for a split-second, or show my key/phrase to the internet for a split-second, it should be considered compromised and I should move all my funds immediately. If I am unsure if my account has real funds in it, I will assume it has real funds in it. If I assume it has real funds in it, I will not use it for developing purposes. I am aware that even if I hit add account on my metamask (or other ETH wallet) I will get a new private key, but it will share the same secret phrase/mnemonic of the other accounts generated in that metamask (or other ETH wallet). **How to Take the Pledge** We'll go over how to take the pledge now. You'll need to open your browser, we'll go over to x.com, you can just type in x.com or Twitter. Then, you can go ahead and copy this link, and we'll go over to our browser and we'll paste the link in here. You can either write a reply or you can comment. Whatever works better for you. **Taking the Pledge** We'll go over how to take the pledge now. You'll need to open your browser, we'll go over to x.com, you can just type in x.com or Twitter. Then, you can go ahead and copy this link, and we'll go over to our browser and we'll paste the link in here. You can either write a reply or you can comment. Whatever works better for you. ```bash https://x.com/ ``` You can type in "I will be safe" either as a reply or a comment. ```bash I WILL BE SAFE ``` And then, we highly recommend if you've taken this fund, I would love it if you you know were to copy the link, go to x.com, or Twitter, or whatever, post a little tweet saying "I will be safe, I have decided to take the .env pledge" and then, you know, tag me at PatrickAlphaC, and then, you know, maybe tag Cyfrinauts or whatever you want to do here. So anyways, now you know once we move on to moccasin, we will probably come back to this again, very briefly, just to again reiterate this .gitignore stuff, and make sure we understand the new pieces. But anyways, thank you for taking this pledge, and thank you for taking yourself seriously. All right, I'm going to go ahead and delete my terminal.
A detailed guide to taking the .env pledge, a commitment to securing your private keys. The lesson covers the common mistakes developers make when storing private keys, the risks involved, and provides three secure methods of encrypting your private keys.
Previous lesson
Previous
Next lesson
Next
Give us feedback
Course Overview
About the course
Python basics
Introduction to Web3.py
Introduction to Titanoboa
Introduction to Moccasin
How to create an ERC-20
How to test Python code and Vyper smart contract
How to deploy Vyper smart contracts on ZKsync using Moccasin
Smart Contract Auditor
$100,000 - $200,000 (avg. salary)
On-chain Data Analyst
$59,000 - $139,000 (avg. salary)
DeFi Developer
$75,000 - $200,000 (avg. salary)
Smart Contract Engineer
$100,000 - $150,000 (avg. salary)
Web3 developer
$60,000 - $150,000 (avg. salary)
Web3 Developer Relations
$85,000 - $125,000 (avg. salary)
Last updated on April 21, 2025
Duration: 2h 20min
Duration: 1h 51min
Duration: 58min
Duration: 2h 23min
Duration: 53min
Duration: 2h 24min
Duration: 28min
Duration: 1h 54min
Duration: 11min
Course Overview
About the course
Python basics
Introduction to Web3.py
Introduction to Titanoboa
Introduction to Moccasin
How to create an ERC-20
How to test Python code and Vyper smart contract
How to deploy Vyper smart contracts on ZKsync using Moccasin
Smart Contract Auditor
$100,000 - $200,000 (avg. salary)
On-chain Data Analyst
$59,000 - $139,000 (avg. salary)
DeFi Developer
$75,000 - $200,000 (avg. salary)
Smart Contract Engineer
$100,000 - $150,000 (avg. salary)
Web3 developer
$60,000 - $150,000 (avg. salary)
Web3 Developer Relations
$85,000 - $125,000 (avg. salary)
Last updated on April 21, 2025
Testimonials
Read what our students have to say about this course.
Chainlink
Chainlink
Gustavo Gonzalez
Solutions Engineer at OpenZeppelin
Francesco Andreoli
Lead Devrel at Metamask
Albert Hu
DeForm Founding Engineer
Radek
Senior Developer Advocate at Ceramic
Boidushya
WalletConnect
Idris
Developer Relations Engineer at Axelar