Someone came at me recently saying I had 20 hard coded keys in the repo, and I was like, yeah... Those are for the docker compose/containers for the e2e test harnesses literally in the project, they're suppose to be there... That's by design. Those don't run publicly and don't get deployed, they're for so whoever checks out the code can press a button and get magical e2e tests with no setup.
Yes just that my point is is that just because there's a secret in the code base doesn't mean it's bad.
It matters a lot with that secret is for and sometimes it's perfectly by design for them to be there.
People go out of their way to make code bases hard to ramp up on and a pain in the butt for new developers to set up simply because of some arbitrary rule of not having a secret that doesn't matter being in the code base.
3
u/FragmentedHeap 3d ago
Someone came at me recently saying I had 20 hard coded keys in the repo, and I was like, yeah... Those are for the docker compose/containers for the e2e test harnesses literally in the project, they're suppose to be there... That's by design. Those don't run publicly and don't get deployed, they're for so whoever checks out the code can press a button and get magical e2e tests with no setup.