# MobileAudit Environment Variables: Complete Configuration Guide for settings.py

> Master MobileAudit environment variables in settings.py. Learn how this app configures runtime settings via env() for seamless deployment without code changes.

- Repository: [Mónica Pastor/mobileaudit](https://github.com/mpast/mobileaudit)
- Tags: how-to-guide
- Published: 2026-03-07

---

**MobileAudit loads all runtime configuration via the `env()` helper from the `getenv` package in [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py), allowing full environment-driven deployment without code changes.**

The mpast/mobileaudit repository is a Django-based mobile application security testing framework. Every configurable value—from database credentials to third-party API keys—is centralized in [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py) and driven entirely by environment variables. This design eliminates the need for separate configuration files per environment and supports containerized deployments natively.

## How Environment Variables Are Loaded in MobileAudit

### The getenv Helper Function

At the top of [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py), the configuration system imports the `env` helper:

```python
from getenv import env

```

This function implements a consistent pattern: `env(name, default)`. It checks the current OS environment for the specified variable name. If present, it returns the value as a string; otherwise, it returns the supplied Python default literal. Because Django evaluates settings at import time, environment variables must be populated before the application starts.

### Type Casting

For numeric or boolean values, the code explicitly casts the result. For example, line 64 reads:

```python
DEBUG = int(env("DEBUG", 0))

```

This ensures that environment strings are converted to the appropriate Python types expected by Django.

## Required and Optional Environment Variables

While every variable has a default defined in [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py), production deployments must override sensitive values. The configuration is organized into logical groups:

### Core Django Settings

These variables control fundamental Django behavior and security:

- **`SECRET_KEY`** (line 62): Cryptographic signing key for sessions and tokens. Default: `"<SECRET_KEY>"` (placeholder).
- **`DEBUG`** (line 64): Debug mode flag (`1` for on, `0` for off). Default: `0`.
- **`DJANGO_ALLOWED_HOSTS`** (line 66): Valid host headers. Default: `['web','app','localhost','127.0.0.1']`.
- **`CSRF_TRUSTED_ORIGINS`** (line 67): Trusted origins for CSRF protection. Default: `['http://web','http://app','http://localhost','http://127.0.0.1']`.
- **`ENV`** (line 72): Environment identifier (`"DEV"` or `"PROD"`).

### Database Configuration

When `ENV` equals `"PROD"`, the application expects PostgreSQL credentials (lines 75-81):

- **`SQL_ENGINE`**: Database backend. Default: `"django.db.backends.sqlite3"`.
- **`SQL_DATABASE`**: Database name. Default: `"db.sqlite3"`.
- **`SQL_USER`**: Database user. Default: `"postgres"`.
- **`SQL_PASSWORD`**: Database password. Default: `"postgres"`.
- **`SQL_HOST`**: Database host. Default: `"db"`.
- **`SQL_PORT`**: Database port. Default: `"5432"`.

### Security Hardening Flags

Production-specific security headers (lines 85-88):

- **`SESSION_COOKIE_SECURE`**: Forces HTTPS-only cookies. Default: `False`.
- **`SECURE_HSTS_PRELOAD`**: HSTS preload flag. Default: `False`.
- **`SECURE_HSTS_INCLUDE_SUBDOMAINS`**: HSTS subdomain inclusion. Default: `False`.
- **`SECURE_BROWSER_XSS_FILTER`**: XSS filter header. Default: `True`.

### Third-Party Service Integrations

**CWE Definitions** (line 53):
- **`CWE_URL`**: Base URL for CWE API. Default: `https://cwe.mitre.org/data/definitions/`.

**Malware Databases** (lines 55-58):
- **`MALWARE_ENABLED`**: Toggle malware checks. Default: `True`.
- **`MALWAREDB_URL`**: Malware Domain List URL.
- **`MALTRAILDB_URL`**: Maltrail domains feed.

**VirusTotal** (lines 59-66):
- **`VIRUSTOTAL_ENABLED`**: Toggle integration. Default: `False`.
- **`VIRUSTOTAL_API_KEY`**: API authentication. Default: empty string.
- **`VIRUSTOTAL_UPLOAD`**: Enable file upload. Default: `False`.

**DefectDojo** (lines 67-70):
- **`DEFECTDOJO_ENABLED`**: Toggle integration. Default: `False`.
- **`DEFECTDOJO_URL`**: Instance URL.
- **`DEFECTDOJO_API_KEY`**: Authentication key.

### Background Task Configuration

Celery message broker settings (lines 87-92):
- **`CELERY_BROKER_URL`**: AMQP broker. Default: `amqp://guest:guest@rabbitmq:5672`.
- **`CELERY_RESULT_BACKEND`**: Result storage. Default: `db+sqlite:///rabbitmq/results.sqlite`.

## Configuration Examples

### Local Development with a .env File

Create a `.env` file in the project root for local testing:

```dotenv
SECRET_KEY=my-local-dev-secret-key-change-in-production
DEBUG=1
DJANGO_ALLOWED_HOSTS=['localhost','127.0.0.1']
CSRF_TRUSTED_ORIGINS=['http://localhost']
ENV=DEV

```

When you run `python manage.py runserver`, the `getenv` package automatically loads these values into the process environment.

### Docker and Kubernetes Deployment

For production containers, inject variables via your orchestration platform:

```yaml

# docker-compose.yml snippet

services:
  web:
    environment:
      - SECRET_KEY=${SECRET_KEY}
      - ENV=PROD
      - SQL_ENGINE=django.db.backends.postgresql
      - SQL_DATABASE=mobileaudit
      - SQL_USER=postgres
      - SQL_PASSWORD=${POSTGRES_PASSWORD}
      - SQL_HOST=db
      - SQL_PORT=5432
      - VIRUSTOTAL_ENABLED=True
      - VIRUSTOTAL_API_KEY=${VT_API_KEY}

```

In Kubernetes, use Secrets for sensitive values like `SECRET_KEY` and `VIRUSTOTAL_API_KEY`, referencing them in your Deployment manifests.

### Accessing Variables Programmatically

While [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py) handles the bulk of configuration, you can use the same helper elsewhere if needed:

```python
from getenv import env

api_key = env('VIRUSTOTAL_API_KEY', '')
if not api_key:
    raise RuntimeError("VirusTotal API key is required for scanning")

```

## Summary

- **Centralized Configuration**: All settings reside in [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py) and use the `env()` helper from the `getenv` package.
- **Environment-Driven Deployment**: No code changes are required between development and production; simply set environment variables.
- **Sensible Defaults**: Every variable has a default value, but production deployments must override `SECRET_KEY`, database credentials, and third-party API keys.
- **Security Controls**: Production-specific flags like `SESSION_COOKIE_SECURE` and `SECURE_HSTS_PRELOAD` are available but default to development-safe values.
- **Integration Ready**: Built-in support for VirusTotal, DefectDojo, malware databases, and Celery task queues via environment configuration.

## Frequently Asked Questions

### What happens if I don't set SECRET_KEY in production?

If you do not override `SECRET_KEY`, the application uses the placeholder default `"<SECRET_KEY>"` defined in [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py) at line 62. This exposes your deployment to critical security vulnerabilities because Django uses this key to sign session cookies and cryptographic tokens. Always generate a unique, random string for production.

### How do I switch from SQLite to PostgreSQL in MobileAudit?

Set `ENV=PROD` and provide the PostgreSQL connection variables. Specifically, set `SQL_ENGINE=django.db.backends.postgresql` and provide values for `SQL_DATABASE`, `SQL_USER`, `SQL_PASSWORD`, `SQL_HOST`, and `SQL_PORT`. When `ENV` equals `"PROD"`, [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py) automatically uses these values instead of the SQLite defaults.

### Can I use a .env file in production?

Yes. The `getenv` package automatically loads variables from a `.env` file if present in the working directory. However, for production deployments, consider using Docker secrets, Kubernetes Secrets, or your orchestration platform's native secret management instead of committing a `.env` file to version control, as this provides better security and audit trails.

### Where are the default values defined?

All default values are defined inline within [`app/config/settings.py`](https://github.com/mpast/mobileaudit/blob/main/app/config/settings.py) as the second argument to the `env()` function calls. For example, line 64 reads `int(env("DEBUG", 0))`, where `0` is the default. The repository also includes an `.env.example` file that documents all recognized variables with example values for reference.