What will happen when you commit secrets to a public Git repo?

Re:What will happen when you commit secrets to a public Git ... by Lex-2008 on Saturday November 07, 2020 @08:24AM (#25014928)

Because it should be OK to commit secrets to private repos - that's why they're _private_, after all, right?

[ Parent | on HN ]

Re:What will happen when you commit secrets to a public Git ... by dorfsmay on Saturday November 07, 2020 @09:07AM (#25015141)

No, that's not not why.

If you have secrets, encrypt them.

Private repos can be turned public, intentionally or by mistake. Repos can be exported to give software to third parties. Also, git users clone repos, which means that those secrets are copied every where. Can you make sure those stay private too? Do you make your developers encrypt their laptops or delete repos from them before they leave their house or office?

[ Parent | on HN ]

Re:What will happen when you commit secrets to a public Git ... by jakub_g on Saturday November 07, 2020 @10:26AM (#25015576)

Also, it's possible that when you have a secret in a private repo, it accidentally leaks when you deploy that repo to a public server. And it's easier to do this than you'd think, e.g. by a mix of a few unrelated changes by different developers.

Also, when an attacker gets access to one private repo by some means, you don't want him to pwn your whole organization.

[ Parent | on HN ]