4 ms·
What I want to know is how are they not using a secret manager (like Doppler or AWS Secrets Manager) at a company of this size? They could have avoided all of t
by AlwaysNewb23 3y ago
What I want to know is how are they not using a secret manager (like Doppler or AWS Secrets Manager) at a company of this size? They could have avoided all of this. These types of leaks can cost companies everything (from their data to customer trust).
- miohtama 3y agoThe root cause: They are not using it because engineers who committed securities to a GitHub repository are not going to have any repercussions. Their salary does not depend on, like the salary of their bosses. So it does not cost anything on a personal level.
- AlwaysNewb23 3y agoYou are very correct but it’s also not on the dev product teams to decide the best practices for secrets at large companies. It’s the responsibility of the security and devops team to implement best practices.
- AlexeyBelov 3y agoSure, it ought to come from above. But what software dev in 2024 doesn't know that keeping everything in the source code is really really bad?