2 ms·

I'd really like you to make a case for why I, as somebody who won't store production credentials in my code repo, should feel good storing them in yours. I run

I'd really like you to make a case for why I, as somebody who won't store production credentials in my code repo, should feel good storing them in yours. I run the a SaaS cron monitoring service (Cronitor.io) and we ourselves make liberal use of SaaS tools to simplify our lives and free us to focus our time on places we can add value. But I'm skeptical of storing all the things our apps need -- private keys, passwords, paths, ports and hostnames -- with you. And that doesn't even touch on the risk that if somebody compromised you, wouldn't they essentially have a key to the back door of every one of your customers? What have you done to mitigate that risk? Aside from all that, congrats on shipping! It's an important milestone.

_query 12y ago
Currently we are working on improving our security by encrypting user data like config files. Then we would store the password for decrypting these data on the client. We would only decrypt these things when required (e.g. when deploying). Note that this is currently only a concept and not implemented yet. Otherwise the same applies to GitHub: If GitHub gets hacked, your application details will also be compromised. > Aside from all that, congrats on shipping! It's an important milestone. Thanks :)
- encoderer 12y ago
  > Otherwise the same applies to GitHub: If GitHub gets hacked, your application details will also be compromised. Right, which is why you don't put your credentials in your source code on Github. This is common practice and one you seem to accommodate in your product, so I know you're very familiar with it... I hope you guys are transparent about these sort of things, it will mean a lot to your adoption rate I think. A lot of people out there who could be interested in a tool like this if they felt comfortable with the security implications.

_query 12y ago

Currently we are working on improving our security by encrypting user data like config files. Then we would store the password for decrypting these data on the client. We would only decrypt these things when required (e.g. when deploying). Note that this is currently only a concept and not implemented yet. Otherwise the same applies to GitHub: If GitHub gets hacked, your application details will also be compromised. > Aside from all that, congrats on shipping! It's an important milestone. Thanks :)

encoderer 12y ago
> Otherwise the same applies to GitHub: If GitHub gets hacked, your application details will also be compromised. Right, which is why you don't put your credentials in your source code on Github. This is common practice and one you seem to accommodate in your product, so I know you're very familiar with it... I hope you guys are transparent about these sort of things, it will mean a lot to your adoption rate I think. A lot of people out there who could be interested in a tool like this if they felt comfortable with the security implications.