14 ms·
I gotta level with you, not everyone knows you shouldn't do that. There's a number of devs that don't think twice about storing sensitive keys in a git repo.
by cogman10 2y ago
I gotta level with you, not everyone knows you shouldn't do that.
There's a number of devs that don't think twice about storing sensitive keys in a git repo.
I could 100% see how someone would do this, see log messages with passwords in plain text, and then faff off being the last person to actually look at those logs. "K, this case is done, what's next"
- vidarh 2y agoI worked somewhere not long ago where the "solution" was to run code to scrub repos before building release packages because these packages were in some cases installed in customer networks that drastically increased the chance they might leak. At no point did it seem developers or the devops team realised that the fact they saw the need to do this meant that maybe they should apply the same checks used to scrub in a hook to root them on commit in the first place.