4 ms·
We actually do this in our internal framework. All secrets (passwords, key material, etc) that we have in documentation and example projects are blacklisted for
by spockz 4y ago
We actually do this in our internal framework. All secrets (passwords, key material, etc) that we have in documentation and example projects are blacklisted for production in the framework itself and applications refuse to start.
- oneepic 4y agoOut of curiosity, do you have any tools/processes to avoid a situation like putting real secrets in new docs? Such as this popular story from 2017 [0]. And is there a way to automate publishing a test secret(s) to a doc and also send it to the blacklist? [0] https://www.reddit.com/r/cscareerquestions/comments/6ez8ag/accidentally_destroyed_production_database_on/ https://www.reddit.com/r/cscareerquestions/comments/6ez8ag/a...
- spockz 4y agoNone other than peer reviews and habit. All our passphrases are something like “exampledatabasepassword” whereas in reality they are long tokens. Then, secrets from production are hard to extract and typically rotated (semi-continuously). So it would be very strange if that somehow ended in up in a developers paste buffer to add to the docs.