3 ms·
Whilst I agree with your objectives and would love a tool that does this. I have not done so myself because of security problems with having .git in the website
by nextw33k 13y ago
Whilst I agree with your objectives and would love a tool that does this. I have not done so myself because of security problems with having .git in the website folder. I'll continue to use git's hooks to copy the files as I push them to the server.
Right now, your source is potentially downloadable via the web, if a developer accidentally places a password in the code and then later reverts the change, its still in the history for someone to find. Plus they get the ability to rip off your work because you've made it public. Or perhaps just scan it for flaws to exploit.
I know what your going to say, that you can mitigate these problems with a simple configuration change. However is everybody that you give the code to going to do that on every server they deploy?
- girvo 13y agoWhat nextw33k said! It's not an issue for me: I _know_ the gotchas when dealing with this stuff (that's why I asked!), but the people I hire in the future might not. I only know about it because I've been burned by it in the past!
- arnoooooo 13y agoI have to admit I missed this aspect. I've only delivered projects where the main folder was not web accessible until now. I agree that this is an issue, I'll have to see if I can find a clever way to get around this.