3 ms·
> Why is that? You don't want to accidentally commit your credentials to github and have the world see them. At least if they're in ENV they stay private as lo
by ebg13 6y ago
> Why is that?
You don't want to accidentally commit your credentials to github and have the world see them. At least if they're in ENV they stay private as long as your environment does.
- chrisfinazzo 6y agoWhat about the global .gitconfig? One of the basic key value pairs is the GPG signingkey, which is usually stored in cleartext in the aforementioned file. Although the credential.helper is in my Keychain (iCloud-backed 2FA) In theory someone could copy this and try to sign commits as me, but I have to think this value is unique and they would get rejected if they tried to use it. My login credentials are 2FA as well, at least on unknown machines, so they would be prompted there as well. Personal Access Tokens for the CLI would be another way to prevent nefarious things from happening.