So I have a web3js script(bot), something along these lines:
let walletAddress = "" let pvtKey = "" signed = await web3.eth.accounts.signTransaction(txObject, pvtKey);
What is the best practise to not have the private key in plain text? I can read it from a file, but if the attacker can escalate his privileges he can also read it from the file.
Using webjs encrypt/decrypt functionality doesn't help either cause in this case I would have the password visible in the script (assuming attacker was able to escalate privileges) so I would just be delaying the problem.
Reading from a vault from azure or aws I guess would be the same if he can get to my script.
What could be the best way to do this without being a hardware wallet (because this is a bot that is constantly posting transactions).