3 ms·

I have always wondered if putting confidential info in even private git repo was a good idea, although it seems to be a common practice? I feel like that questi

I have always wondered if putting confidential info in even private git repo was a good idea, although it seems to be a common practice? I feel like that question has been answered, for me anyway.

nijave 5y ago
Definitely not a good idea. Source code gets sprinkled around a lot of locations with varying security - it's stored locally (so any developer machine access could compromise secrets) - it's stored on the build/CI machines (that might run untrusted code in the form of dependencies--possibly from unrelated repos) - it can end up in build artifacts