528
Developer posts secret key on GitHub, loses $40K in 2 minutes
(cointelegraph.com)
This is a most excellent place for technology news and articles.
If you have your secret keys in your repository you've already fucked up, long before you accidentally make that repository public.
One of the first things you should do in a repo is add a .gitignore file and make sure there are rules to ignore things like
*secret*
or*private*
etc. Also, I pretty much never usegit add .
because I don't like the laziness of it and EVERY TIME one of my coworkers checked in secrets they were using that command.Better yet you can configure gitignore globally for git. I do this mostly to avoid polluting repo ignore files with my editor specific junk but *.key and similar can help prevent accidents.
https://git-scm.com/docs/gitignore
For personal projects that's definitely a good idea. For team projects I like to keep that stuff in the project still so the "experience" of working in the project is mostly consistent.
I started using git-secret 2 years ago. It's nice for making secrets part of the repo, while not being readable by anyone that isn't explicitely allowed to do so (using GPG).
I think you really need the project specific gitignore as well, to make sure any other contributor that joins by default has the same protections in place.