3 ms·

I would venture to guess the main concern is accidental commit of decrypted secrets.

• NewJazz 1y ago
  That can happen regardless.
• thomasingalls 1y ago
  If a key gets compromised, the encrypted secrets are compromised forever, since you can't be sure all the git clones everywhere can be updated with a new encryption key. Not to mention how fiddly it is to edit git history.
  • NewJazz 1y ago
    But you can and should be rotating those secrets on some schedule regardless, and if you find out a key has been compromised you can immediately rotate the secrets.
  • dvtkrlbs 1y ago
    I would assume if you are committing encrypted secrets you would make sure they are rotatable