5 ms·

so yeah, dev have access to the password of your account, but really they dont need it, they probably have access to the hash in the database and login anyway.

by polote 8y ago

so yeah, dev have access to the password of your account, but really they dont need it, they probably have access to the hash in the database and login anyway. So really NO harm have been done

p_rude 8y ago
It is neither a standard practice nor a best practice to give your devs access to your production auth databases.
- icedchai 8y ago
  Perhaps not in more mature organizations, but it's standard practice at every startup I've ever worked for. One place had the dev office VPN'd into production at all times.
  - glenneroo 8y ago
    Did any of those startups have 200-600 million users?
    - icedchai 8y ago
      No, these were small organizations. I'm just saying it's not uncommon. Sadly, some places don't even have a dev environment...
EnFinlay 8y ago
Having (read) access to the hash shouldn't give any access to the account. Edit: You've made this comment twice in these threads. It's wrong.
- polote 8y ago
  Yeah I was wrong, it is only true if the dev has access to the prod database