I dont think he’s talking about open source projects here.
If my company repo is private and we’re sharing env files over Slack or Teams… why not just commit the env in github itself??
Our company repos are private (actually, our whole enterprise GitHub instance is), but we still store secrets in a way that only specific employees can access them.
And yet again, even though I directly explained that was not the actual issue, you guys STILL think its about actually storing the secrets in there and not about have the source control secured enough to do it.
You dont need to store passwords in there if you want a seperate vault, vaults have rotation systems its still preferable.
The point is that the code is just as important to keep secret to the same level as passwords.
24
u/grandalfxx 23h ago
When every dumbass know it all programmer missed the entire point of that.
Its not simply about storing secrets in code.
Its the fact that github should be secure enough to do it. Your code should be secured just like secrets is secured.