3 ms·

Why? It sounded like he is very security conscious. Thought he was creating a private repo in VS, immediately after he was notified deleted and recreated his

• famousactress 11y ago
  Because anyone who ever says "I didn't think it was possible that I could be the victim of a data breach" is dangerously delusional, and in case I'm not being clear - wrong. Also putting keys in (even a private) cloud-hosted repos is at least a step under what I'd describe as "very security conscious" for someone who self describes as working in the financial industry.
• cptnbob 11y ago
  1. He stored credentials in source control rather than using configuration profiles as specified in the AWS SDK documentation. 2. He pushed code to a new repository without verifying the security configuration of the created repository (granted the tool made it easy to do this but you should create a repo, verify it, then push code). 3. He used his master AWS account key/secret in the code which gave global access to everything. 4. He didn't use IAM credentials with a restrictive policy set to just access the resources required. No, clearly not security concious. I'm a solution architect in the financial services industry and have been for 16 years. Never do I assume I know what the hell I'm doing.