3 ms·

I don't think it being in the cloud or not makes a difference. Applications that aren't in the cloud can still be broken into. Leaving things in source control

• umvi 7y ago
  > I don't think it being in the cloud or not makes a difference. Applications that aren't in the cloud can still be broken into. So if the attacker has already broken into our corporate networks and can access the internal applications directly, what's to stop them from just examining the environment variables directly to get the secrets from there? I don't understand the added value of Vault. We have secrets committed to internal GitLab where you need an LDAP account to even view/clone the repo. The secrets are used for internal applications that make calls to external APIs (like a weather service). If the attacker can gain access to the GitLab source, surely it's equally trivial to just examine the environment variables of the internal application itself since the secrets will be in plain text. And if the secrets are not in plain text (i.e. you are passing the secret encrypted), then surely the attacker need only examine the source code (which we've established he has access to) to see how to decrypt the secret from the environment variable. Seems like an impossible chicken and egg problem.