diff --git a/.changesets/1792608066-c6cfa9bb.yaml b/.changesets/1792608066-c6cfa9bb.yaml
new file mode 100644
index 000000000..55cabce3e
--- /dev/null
+++ b/.changesets/1792608066-c6cfa9bb.yaml
@@ -0,0 +1,10 @@
+id: 1792608066-c6cfa9bb
+features:
+    - envVarSecurityUsage
+targets:
+    - pythonv2
+type: fix
+bump: patch
+description: omit the empty-string default from os.getenv in usage snippets for optional security fields so an unset environment variable no longer sends an empty credential
+author: LukasParke
+date: "2026-10-21"
diff --git a/templates/templates/pythonv2/includes/sanitization.ts b/templates/templates/pythonv2/includes/sanitization.ts
index 74309517a..2d9bf6bfc 100644
--- a/templates/templates/pythonv2/includes/sanitization.ts
+++ b/templates/templates/pythonv2/includes/sanitization.ts
@@ -2688,7 +2688,14 @@ registerTemplateFunc("paginationRequestNoneGuard", paginationRequestNoneGuard);
 function languageSpecificEnvVarWrapping(
   envVar: EnvVar,
   additionalContext?: TemplateValueContext,
+  fieldDef?: FieldDef,
 ): string {
   addImport("os", "");
+  if (
+    envVar.defaultValue === "" &&
+    (fieldDef?.Optional || fieldDef?.Nullable)
+  ) {
+    return `os.getenv("${envVar.name}")`;
+  }
   return `os.getenv("${envVar.name}", "${envVar.defaultValue}")`;
 }