3 ms·
Storing API keys in Git, nice.
by computerfriend 4y ago
Storing API keys in Git, nice.
- not2b 4y agoApparently this was a private repo, not a public one, but the attacker gained access.
- shkkmo 4y agoIt is still a very bad idea to store unencrypted keys in a private repository. You've now equated read access of your repository will whatever access that key has.
- rtev 4y agoThat doesn’t matter, best practice is storing them as variables that are injected upon deployment from a secret manager.
- insanitybit 4y agoFWIW Dropbox had robust infrastructure to do exactly that when I was there as well as scanning for API keys in the main repository. Certainly product code is going to conform to the pattern you've described, this sounds to me like some of the random non-product projects that may hit some external non-dbx API were not doing things properly and it flew under the radar for whatever reason. I highly doubt these API keys could have been used for much. So yes, I agree with you, but here's some context. Disclaimer: I haven't worked there since 2019
- deleted 4y ago[deleted]
- bastawhiz 4y agoIf it was GitHub and they were using GitHub auth for circleci, they could have gotten access to injected secrets. Or, if they used GitHub actions, it could have been actions environment variables. It isn't clear that keys were checked into source control.