How much does zuzu.codes cost?

The starter track is free — read all lessons and practice for free. Full access to every track (current and future) is $14.99/month. Cancel anytime.

How long does each track take?

Each track is designed as a 30-day challenge — one lesson per day, about 15 minutes each. Go at your own pace, but the structure is built around daily consistency.

What's the lesson format?

Each lesson is a student-teacher dialogue with code examples, followed by a hands-on code challenge in an in-browser editor. You read, you understand, then you write real code.

Do I need prior coding experience?

Our beginner track starts from absolute zero — no prior experience needed. Advanced tracks build on earlier ones, and the platform tells you exactly where to start.

How is zuzu.codes different from freeCodeCamp or Codecademy?

zuzu.codes uses a structured 30-day track format with dialogue-based teaching, an in-browser code editor, and gamification (XP, streaks, progress tracking). The format builds genuine understanding through daily practice.

Secrets via environment — Automation Mastery

Day 12 · ~11 min●

A hardcoded API key in source is a leak waiting to happen — committed to git, shared in screenshots, copied into chat threads. The fix is one of the oldest patterns in production code: read secrets from environment variables.

python

import os

API_KEY = os.environ.get("API_KEY")
if not API_KEY:
    raise RuntimeError("API_KEY env var not set")

print("API_KEY: present")    # never print the value itself

Why os.environ.get over os.environ[]?

os.environ.get("API_KEY") returns None when the variable isn't set — you handle the None yourself with a meaningful error. os.environ["API_KEY"] raises KeyError, which is less informative. Either works; .get + explicit check is clearer about intent.

And why never print the key?

Logs end up in lots of places — your terminal scrollback, log aggregators, error trackers, CI build outputs. Printing a secret means it's now in all of them. Print existence (API_KEY: present), print length (32 chars), print prefix-only (sk-abc...) if you must — never the full value.

Secrets via environment variables

The rule

Never hardcode secrets. API keys, tokens, passwords, signing secrets, database URLs with credentials — none of these belong in source code.

The fix

python

import os

API_KEY = os.environ.get("API_KEY")
if not API_KEY:
    raise RuntimeError("API_KEY env var not set")

Two lines. The pattern is identical in every script that touches a credential.

Where the env var actually lives

Environment	How you set it
Local dev	`.env` file loaded via `python-dotenv`, or `export API_KEY=... && python script.py`
Production (Vercel)	Project settings → Environment Variables
Production (any cloud)	platform-specific UI — Heroku config vars, AWS Parameter Store, etc.
CI	repository secrets (never committed; injected at run-time)

Three things to print, none of them the value

python

# all safe to print:
print(f"API_KEY: {'present' if API_KEY else 'MISSING'}")
print(f"API_KEY length: {len(API_KEY)}")
print(f"API_KEY prefix: {API_KEY[:6]}...")     # for tokens with sensible prefixes (sk-, pk_)

# never print:
print(API_KEY)                                  # leaks the secret to logs
print(f"using {API_KEY}")                       # same

Required vs optional secrets

python

# REQUIRED — must crash at startup if missing
API_KEY = os.environ["API_KEY"]                 # KeyError if missing — fail-fast

# REQUIRED, friendlier error
API_KEY = os.environ.get("API_KEY")
if not API_KEY:
    raise RuntimeError("API_KEY env var not set — see README")

# OPTIONAL — falls back to a default
LOG_LEVEL = os.environ.get("LOG_LEVEL", "INFO")

`.env` files for local dev

# .env  (NEVER commit this file)
API_KEY=sk-abc123...
DATABASE_URL=postgres://...

python

from dotenv import load_dotenv
load_dotenv()        # reads .env into os.environ

import os
api_key = os.environ["API_KEY"]

Add .env to .gitignore always. Add a .env.example with no real values to git so collaborators know which variables are required.

Beware substring leaks

Besides direct prints, secrets leak through:

Exception tracebacks that include the URL with the key in it (?api_key=sk-...)
Logging the entire request object
Sentry/error trackers without scrubbing

Sanitize what you log. For URLs with query-string secrets, log the path only:

python

from urllib.parse import urlparse
print(urlparse(url).path)        # "/items" — no query string

Day 12 · ~11 min●

python

import os

API_KEY = os.environ.get("API_KEY")
if not API_KEY:
    raise RuntimeError("API_KEY env var not set")

print("API_KEY: present")    # never print the value itself

Why os.environ.get over os.environ[]?

And why never print the key?

Secrets via environment variables

The rule

Never hardcode secrets. API keys, tokens, passwords, signing secrets, database URLs with credentials — none of these belong in source code.

The fix

python

import os

API_KEY = os.environ.get("API_KEY")
if not API_KEY:
    raise RuntimeError("API_KEY env var not set")

Two lines. The pattern is identical in every script that touches a credential.

Where the env var actually lives

Environment	How you set it
Local dev	`.env` file loaded via `python-dotenv`, or `export API_KEY=... && python script.py`
Production (Vercel)	Project settings → Environment Variables
Production (any cloud)	platform-specific UI — Heroku config vars, AWS Parameter Store, etc.
CI	repository secrets (never committed; injected at run-time)

Three things to print, none of them the value

python

# all safe to print:
print(f"API_KEY: {'present' if API_KEY else 'MISSING'}")
print(f"API_KEY length: {len(API_KEY)}")
print(f"API_KEY prefix: {API_KEY[:6]}...")     # for tokens with sensible prefixes (sk-, pk_)

# never print:
print(API_KEY)                                  # leaks the secret to logs
print(f"using {API_KEY}")                       # same

Required vs optional secrets

python

# REQUIRED — must crash at startup if missing
API_KEY = os.environ["API_KEY"]                 # KeyError if missing — fail-fast

# REQUIRED, friendlier error
API_KEY = os.environ.get("API_KEY")
if not API_KEY:
    raise RuntimeError("API_KEY env var not set — see README")

# OPTIONAL — falls back to a default
LOG_LEVEL = os.environ.get("LOG_LEVEL", "INFO")

`.env` files for local dev

# .env  (NEVER commit this file)
API_KEY=sk-abc123...
DATABASE_URL=postgres://...

python

from dotenv import load_dotenv
load_dotenv()        # reads .env into os.environ

import os
api_key = os.environ["API_KEY"]

Add .env to .gitignore always. Add a .env.example with no real values to git so collaborators know which variables are required.

Beware substring leaks

Besides direct prints, secrets leak through:

Exception tracebacks that include the URL with the key in it (?api_key=sk-...)
Logging the entire request object
Sentry/error trackers without scrubbing

Sanitize what you log. For URLs with query-string secrets, log the path only:

python

from urllib.parse import urlparse
print(urlparse(url).path)        # "/items" — no query string

Secrets via environment variables

The rule

The fix

Where the env var actually lives

Three things to print, none of them the value

Required vs optional secrets

`.env` files for local dev

Beware substring leaks

Secrets via environment variables

The rule

The fix

Where the env var actually lives

Three things to print, none of them the value

Required vs optional secrets

`.env` files for local dev

Beware substring leaks

Secrets via environment variables

The rule

The fix

Where the env var actually lives

Three things to print, none of them the value

Required vs optional secrets

`.env` files for local dev

Beware substring leaks

Sign up to practice

Secrets via environment variables

The rule

The fix

Where the env var actually lives

Three things to print, none of them the value

Required vs optional secrets

`.env` files for local dev

Beware substring leaks

Sign up to practice

Secrets via environment variables

The rule

The fix

Where the env var actually lives

Three things to print, none of them the value

Required vs optional secrets

.env files for local dev

Beware substring leaks

Secrets via environment variables

The rule

The fix

Where the env var actually lives

Three things to print, none of them the value

Required vs optional secrets

.env files for local dev

Beware substring leaks

Secrets via environment variables

The rule

The fix

Where the env var actually lives

Three things to print, none of them the value

Required vs optional secrets

.env files for local dev

Beware substring leaks

Sign up to practice

Secrets via environment variables

The rule

The fix

Where the env var actually lives

Three things to print, none of them the value

Required vs optional secrets

.env files for local dev

Beware substring leaks

Sign up to practice

`.env` files for local dev

`.env` files for local dev

`.env` files for local dev

`.env` files for local dev