From 28628f799c8573489dfd2619df3a21b8063b3690 Mon Sep 17 00:00:00 2001
From: Luke Parke <5702154+LukasParke@users.noreply.github.com>
Date: Wed, 21 Oct 2026 18:45:02 +0000
Subject: [PATCH] fix(python): stop defaulting env-var credentials to an empty
 string in usage snippets

With envVarPrefix configured, Python usage snippets read security values
from the environment as os.getenv("PREFIX_API_KEY", ""). When the
variable is unset, the snippet passes an explicit empty string, which the
SDK treats as a provided credential and sends as an empty value (for
example "Authorization: Bearer ").

Render os.getenv("PREFIX_API_KEY") without a default when the target
security field is optional or nullable. The generated constructor and
model already accept None there, so the snippet still type-checks under
pyright and mypy, and an unset variable now leaves the credential absent.
Required str fields keep the "" default so the snippet remains
type-correct.
---
 .changesets/1792608066-c6cfa9bb.yaml                  | 10 ++++++++++
 templates/templates/pythonv2/includes/sanitization.ts |  7 +++++++
 2 files changed, 17 insertions(+)
 create mode 100644 .changesets/1792608066-c6cfa9bb.yaml

diff --git a/.changesets/1792608066-c6cfa9bb.yaml b/.changesets/1792608066-c6cfa9bb.yaml
new file mode 100644
index 000000000..55cabce3e
--- /dev/null
+++ b/.changesets/1792608066-c6cfa9bb.yaml
@@ -0,0 +1,10 @@
+id: 1792608066-c6cfa9bb
+features:
+    - envVarSecurityUsage
+targets:
+    - pythonv2
+type: fix
+bump: patch
+description: omit the empty-string default from os.getenv in usage snippets for optional security fields so an unset environment variable no longer sends an empty credential
+author: LukasParke
+date: "2026-10-21"
diff --git a/templates/templates/pythonv2/includes/sanitization.ts b/templates/templates/pythonv2/includes/sanitization.ts
index 74309517a..2d9bf6bfc 100644
--- a/templates/templates/pythonv2/includes/sanitization.ts
+++ b/templates/templates/pythonv2/includes/sanitization.ts
@@ -2688,7 +2688,14 @@ registerTemplateFunc("paginationRequestNoneGuard", paginationRequestNoneGuard);
 function languageSpecificEnvVarWrapping(
   envVar: EnvVar,
   additionalContext?: TemplateValueContext,
+  fieldDef?: FieldDef,
 ): string {
   addImport("os", "");
+  if (
+    envVar.defaultValue === "" &&
+    (fieldDef?.Optional || fieldDef?.Nullable)
+  ) {
+    return `os.getenv("${envVar.name}")`;
+  }
   return `os.getenv("${envVar.name}", "${envVar.defaultValue}")`;
 }