Config

Store config in the environment. Config is everything that changes between deploys: database addresses, credentials for other services, the hostname the app runs on. Code is what stays the same.

A quick test: could you make the repository public right now without leaking a password? If not, config is mixed into your code.

#Move it out of the code

import mysql.connector
 
db = mysql.connector.connect(
    host="prod-db.internal",
    user="shop",
    password="s3cret!",  # now in git history forever
    database="shop",
)

os.environ["DB_HOST"] fails at startup if the variable is missing, which is what you want: a clear error now beats connecting to the wrong database later.

#One release, many environments

#Use a .env file locally

Typing variables into every terminal gets old. Keep them in a .env file, load it at startup, and never commit it.

DB_HOST=localhost
DB_USER=shop
DB_PASSWORD=devpassword
DB_NAME=shop

from dotenv import load_dotenv
 
load_dotenv()  # reads .env if it exists; real environment variables win

.env

Commit a .env.example with the variable names and fake values instead, so the next developer knows what to set.