4 ms·
Github private repos have been made public by mistake before. Got repos are cloned on dev laptops, do you enforce laptop encryption? The right thing to do is u
by dorfsmay 10y ago
Github private repos have been made public by mistake before. Got repos are cloned on dev laptops, do you enforce laptop encryption?
The right thing to do is using some form of a vault.
- cyberferret 10y agoWe use BitBucket here, rather than Github - similar risks, I know, but we have predetermined repositories which are all set as private. 3 dev machines which are kept on premises at all times. Still not optimal as far as security goes, but it seems that he have roughly the same exposure if AWS leaks our keys and passwords to other third party trackers...
- Ixiaus 10y agoUse kms and dynamodb with key enveloping, or this tool: https://github.com/fugue/credstash https://github.com/fugue/credstash Don't initialize into env vars and don't store in repos, even private ones.
- cyberferret 10y agoThanks - sounds like a good solution. I will look into this in detail over the weekend.
- fletchowns 10y agoBe careful when modifying user access to a private BitBucket repository. Their autosuggest for the username input field will show all bitbucket users. Makes it incredibly easy to accidentally grant somebody outside of your organization access to a repository.
- iampims 10y agoI can attest to that. I have the username "tim" on bitbucket and get added to private repos all the time by mistake.
- fletchowns 10y agoOn top of that, there's no audit history of who has had access to a repository. Absolutely ridiculous.
- fapjacks 10y agoThis is really the best suggestion. I've been using Hashicorp's Vault for storing sensitive configuration information and can't recommend it enough. The rest of Hashicorp's stack of software for Docker is also extremely nice.