4 ms·

Ask HN: How To Secure My Open Source Repo

6 points by Ryel 13y ago

I'm getting ready to make public a few of my private repos. I have various things from scripts to libraries to routers and website clones. I'm just wondering what security concerns I need to cover before making these repos public? -I never directly enter my Amazon AWS credentials -I've removed Heroku credentials of all kinds -I've removed most of my site-specific syntax just in case.. -Removed database credentials Any other "gotchas" that I should worry about? Do you have any experiences with people doing malicious things to your open source projects?

abimaelmartell 13y ago
You removed heroku credentials, but, are they still in the git history?
- zachlatta 13y ago
  Definitely check this. You might find https://help.github.com/articles/remove-sensitive-data https://help.github.com/articles/remove-sensitive-data helpful.
  - Ryel 13y ago
    Was just looking for this, thanks!
    - citruspi 13y ago
      Check for database credentials too - you said you removed them, but they're probably still in the history.
- Ryel 13y ago
  The only Heroku information that I've ever put into repos is occasional plugin information. Nothing critical to security but definitely specific to the particular site. (potentially a security risk that I may not be aware of) I will take care of it just in case, thanks!
borplk 13y ago
I suggest that you copy the files (after they have been cleaned) over and create a fresh new and empty git repository, then publish that instead. Don't publish the original git repository that contains the history.