News for hackers. Stuff that matters.

A comment on A mistakenly published password exposed Mercedes-Benz source code. Parent comment

Re:A mistakenly published password exposed Mercedes-Benz sou... by wendyshu on Tuesday January 30, 2024 @10:18AM (#39191066)
> Your source code repo should never contain secrets like API keys.

Why not?

[ Parent | on HN ]
Re:A mistakenly published password exposed Mercedes-Benz sou... by reaperman on Tuesday January 30, 2024 @10:22AM (#39191134)
1) Because exactly this happens

2) Because developers check out that source code and store it on their own laptops, which can sometimes get lost, stolen, or hacked.

3) Because with a proper secrets manager, each developer can get their own auth credentials for each service, increasing auditability.

[ Parent | on HN ]
Re:A mistakenly published password exposed Mercedes-Benz sou... by chandler767 on Tuesday January 30, 2024 @10:23AM (#39191151)
Ask Mercedes-Benz. If somehow that repo gets exposed - so are all of your secrets. You just made a problem a lot worse and potentially opened up an avenue to expose more data.
[ Parent | on HN ]