# Security Best Practices for Flow SDK Testing

## API Key Management

### Never Hardcode API Keys
- **DO NOT** hardcode API keys in test files, even for testing
- **DO NOT** commit API keys to version control
- **DO NOT** include API keys in documentation or examples

### Use Environment Variables
Tests that require real API access should:
1. Read API keys from environment variables
2. Skip tests if API keys are not available
3. Use pytest fixtures to manage API key configuration

Example:
```python
import os
import pytest

@pytest.mark.e2e
def test_real_api_call():
    api_key = os.environ.get("FCP_API_KEY")
    if not api_key:
        pytest.skip("FCP_API_KEY environment variable not set")
    
    # Use api_key for testing...
```

### Mock API Calls When Possible
- Use mocks for unit tests to avoid needing real API keys
- Only use real API keys for integration/E2E tests that truly need them
- Keep the number of tests requiring real API access minimal

### CI/CD Configuration
- Store API keys as encrypted secrets in CI/CD systems
- Use separate test API keys with limited permissions
- Rotate test API keys regularly
- Monitor test API key usage for anomalies

### Documentation
- Use placeholders like `<your-api-key>` in documentation
- Add notes about where to obtain API keys
- Include security warnings about key management

## Other Sensitive Data
- Apply the same principles to any sensitive configuration
- Use environment variables for project IDs, endpoints, etc.
- Sanitize logs and test outputs before sharing