Improve password security by using environment variables with fallback to default password

README.md

@@ -26,8 +26,17 @@ This space runs VSCode in a Docker container with a web interface.
 2. Access VSCode through the generated URL
 3. Default password/token is `huggingface`
 
+## Custom Password
+To set a custom password:
+1. Go to your Space settings
+2. Add a "Space secret" with key `PASSWORD` and your desired password as the value
+3. Restart the Space for changes to take effect
+
 ## Troubleshooting
 - If you see a warning about NVIDIA Driver not being detected, this is normal when running in certain environments. GPU functionality will be available when the container is run with proper NVIDIA Container Toolkit support.
 - If you get an error about missing password, make sure the PASSWORD environment variable is set or a password is configured in the code-server config file.
 
+## Security
+For better security, use Space secrets to set your password instead of hardcoding it in the files. This prevents the password from being exposed in the repository.
+
 Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

start_server.sh

@@ -2,8 +2,8 @@
 # Create data directory if it doesn't exist
 mkdir -p /data
 
-# Set password as environment variable
-export PASSWORD="huggingface"
+# Set password from environment variable, with fallback to default
+export PASSWORD="${PASSWORD:-huggingface}"
 
 # Generate code-server config
 mkdir -p ~/.config/code-server