Launch HN: Datree (YC W20) – Best practices and security policies on each commit

Re:Launch HN: Datree (YC W20) – Best practices and security ... by shimont on Tuesday March 10, 2020 @01:51PM (#22537709)

Initially, we started as a CLI tool, but as you said, it is part of the problem, how do you make sure all of your developers are using the CLI/pre-commit hooks?

This is why we choose to integrate on the pull-request level. It is not perfect, but at least your plain text secrets will not be merged into master and go in onto your developer's laptops and your servers(less). :)

We try to find a balance between perfect and achievable in an easy way for our customers

[ Parent | on HN ]

Re:Launch HN: Datree (YC W20) – Best practices and security ... by lasryaric on Tuesday March 10, 2020 @04:24PM (#22539306)

But it’s already in the git objects and therefore accessible to anyone who clones the repository? I am not 100% sure about that. Can someone confirm?

[ Parent | on HN ]

Re:Launch HN: Datree (YC W20) – Best practices and security ... by shimont on Tuesday March 10, 2020 @08:00PM (#22541422)

We educate our customers on how to delete the branch and remove it from history: https://docs.datree.io/docs/do-not-include-secret-files

[ Parent | on HN ]

Re:Launch HN: Datree (YC W20) – Best practices and security ... by ben509 on Wednesday March 11, 2020 @01:22AM (#22543212)

I think you're miseducating your customers.

If creds leak, rotate those creds. Then, you check your logs to make sure there was no intrusion.

"Rotate the creds" gives the absolute best guarantee that they're useless. Three words I can explain to a nervous manager.

"What if someone got ahold of those creds?"

"Well, boss, here's the window in which it could have happened, and let's go over these logs together to see if it did."

Scrubbing the repo? I'm skeptical that you're getting rid of anything without push --force, and you sure as heck aren't running `git gc --prune` on the remote system, let alone `bfg`.

[ Parent | on HN ]

Re:Launch HN: Datree (YC W20) – Best practices and security ... by shimont on Wednesday March 11, 2020 @01:36AM (#22543276)

I totally agree! you should rotate the keys! we explain how to get rid of it in terms of Git. This is in addition to rotating it. Sorry for not being clear

[ Parent | on HN ]