I have made a custom module that contains my backup_migrate module profiles as described in this post. Inside the array are my keys to log in to Amazon S3, which I certainly want to keep secret.

Putting such data in code inside a module immediately set off an alarm inside my head. Is this a terrible thing to do from a security standpoint? If so, why?

1 Answer 1


As long nobody is able to read this php files, there's no problem. If your host is set-up correctly and you are using the standard .htaccess file which comes with core, you should be fine.

An other question is who has access to your host and your source code. A good practice is to avoid any sensitive data inside git or any other source control system. A way to do this is to have a local.settings.php file a longside your settings.php. You can include it in your settings.php by ading this code at the end of the file:

if (file_exists(dirname(__FILE__) . '/local.settings.php')) {
  include(dirname(__FILE__) . '/local.settings.php');

Make sure this local.setings.php file is never visible to unauthorized people.

You can set any system variable in local.settings.php to your needs.

  • This answer is solid. To add an additional bit of info, one drawback to a .module file is that most webservers don't know about them so they will serve them up as plaintext if the .htaccess isn't configured properly. I would definitely want to store the keys in a .php file (which most webservers will execute rather than serving as plain text) and then include that php file into the module.
    – greggles
    Apr 13, 2012 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.