Definitely a good idea to whitelist ips, and, I'm certainly no security expert, but I still would avoid putting any type of credentials in a repository. Someone

Definitely a good idea to whitelist ips, and, I'm certainly no security expert, but I still would avoid putting any type of credentials in a repository. Someone could have an ip reset, use a VPN tunnel, or any number of scenarios. I think it is better practice to use environment variables or something similar. Correct me if I'm wrong for those of you who are in security.