Anyone can access deleted and private repository data on GitHub

Re:Anyone can access deleted and private repository data on ... by cellis on Wednesday July 24, 2024 @11:27PM (#41064458)

Putting keys in repos should not be done, full stop. Even if GitHub forks weren’t public, their _private_ repos could one day be compromised. Instead, store keys in a shared vault, .gitignore the .env and have a .env.example with empty keys.

[ Parent | on HN ]

Re:Anyone can access deleted and private repository data on ... by jiggawatts on Thursday July 25, 2024 @02:16AM (#41065268)

Any time I hear “shouldn’t be done” I translate that to “will happen regularly”.

I do see this regularly in my work. All but one dev team I’ve worked with over the last few years has done this.

[ Parent | on HN ]

Re:Anyone can access deleted and private repository data on ... by Eisenstein on Thursday July 25, 2024 @09:45AM (#41068627)

Don't blame the end user for doing something you don't want them to do if it is more convenient to do and works without immediate consequences. Redesign it or rethink your assumptions.

[ Parent | on HN ]