3 ms·

I've heard before of it just being stored in the codebase. Doesn't add much security but it does mean both the database server and at least 1 of the app servers

I've heard before of it just being stored in the codebase. Doesn't add much security but it does mean both the database server and at least 1 of the app servers or the codebase have to be breached

koolba 10y ago
> I've heard before of it just being stored in the codebase. Yuck! At the very least put it in an environment variable. Best case is loaded once at server boot from an HSM, kept only in memory, and rotated on a regular basis. Having it in the code, like all other config, is a terrible idea.
- sandGorgon 10y ago
  If we don't have a hsm? Apparently,neither does Dropbox. So how do you engineer one ?
  - morgante 10y ago
    Use something like Vault: https://www.vaultproject.io/ https://www.vaultproject.io/