3 ms·
You have a key on a single machine that can only read a single repository with no additional hassle about securing the agent to not give out all your secrets at
by janci 5y ago
You have a key on a single machine that can only read a single repository with no additional hassle about securing the agent to not give out all your secrets at once, while it does not add any additional risk, as the remote machine already has full copy of the repo, so there is almost nothing to gain with the key if attacker had compromised the machine already.
- dataflow 5y agoIf someone lifts the key they get perpetual access to your entire repo without any further need to have access to your machine. If they lift the repo then they get a snapshot of the branch(es) you have have in it at that moment in time - they'll need continued access to the machine if they want continued access to the data. There can be a nontrivial difference here right?