5 ms·

> Your source code repo should never contain secrets like API keys. Why not?

• reaperman 3y ago
  1) Because exactly this happens 2) Because developers check out that source code and store it on their own laptops, which can sometimes get lost, stolen, or hacked. 3) Because with a proper secrets manager, each developer can get their own auth credentials for each service, increasing auditability.
• chandler767 3y ago
  Ask Mercedes-Benz. If somehow that repo gets exposed - so are all of your secrets. You just made a problem a lot worse and potentially opened up an avenue to expose more data.