Not for secrets. Scripts in an environment's activate.d folder are executable code that runs every time someone activates the environment, and the conda documentation recommends its config API for plain variables instead. Keep credentials in a secrets manager and inject them at run time.
What activate.d does
Conda lets you attach files to an environment so they run on activation and deactivation. On Linux and macOS you create etc/conda/activate.d and etc/conda/deactivate.d inside the environment directory and drop shell scripts in them. On Windows the files are batch scripts. The conda guide uses them to set and unset variables such as a key or a file path.
The same guide adds a note: setting environment variables through the config API is recommended as an alternative, because activation scripts are an execution of arbitrary code that may not be safe.
Two separate risks
| Risk | What it means |
|---|---|
| Code runs on activation | Anyone who can write into the environment can add a script that runs as the next person who activates it |
| Secret sits in a file | A key written into a script is readable by anyone with file access, and may be copied with the environment |
The first matters most on shared servers and in environments you copy or share. An environment is a folder of executable content, and a hook folder is one more place that content can hide.
How to check an environment
- List the files in the activate.d and deactivate.d folders of every environment you inherit.
- Read each script before you activate the environment for the first time.
- Search the scripts for keys, tokens and passwords.
- Compare against a freshly built environment from your spec, and investigate differences.
- Rotate any credential you find in a file, since it may already have been copied.
ls "$CONDA_PREFIX/etc/conda/activate.d" "$CONDA_PREFIX/etc/conda/deactivate.d"
Better patterns
- Use the conda config API for non secret variables such as paths and feature flags.
- Load secrets from a manager or your platform at process start, and keep them out of the environment folder entirely.
- Build environments from a committed spec, so a hand edited folder is easy to spot and replace.
- Do not share a whole environment directory when a spec file will do.
Notebook users hit a related problem when they paste keys into cells, which the existing guide on keeping API keys out of Jupyter notebooks covers at /resources/blog/how-to-keep-api-keys-out-of-jupyter-notebooks.
Safeguard note
Safeguard's compliance and evidence automation can record that a secrets handling policy exists and who approved it. It does not do secret scanning, so use a dedicated tool for finding keys in files. Dependency checks are available through the free scan at gold.safeguard.sh/scan.
Quick check
Does an activate.d script run only for the owner?
It runs for whoever activates the environment, so a shared environment is shared code.
What does conda suggest instead for variables?
Its config API, as an alternative to activate and deactivate scripts.
Sources
- Managing environments, conda documentation, fetched 19 October 2026.
Last reviewed: 19 October 2026.
