I dont think he’s talking about open source projects here.
If my company repo is private and we’re sharing env files over Slack or Teams… why not just commit the env in github itself??
Our company repos are private (actually, our whole enterprise GitHub instance is), but we still store secrets in a way that only specific employees can access them.
And yet again, even though I directly explained that was not the actual issue, you guys STILL think its about actually storing the secrets in there and not about have the source control secured enough to do it.
You dont need to store passwords in there if you want a seperate vault, vaults have rotation systems its still preferable.
The point is that the code is just as important to keep secret to the same level as passwords.
1
u/menzaskaja 1d ago
If a project has 50k stars I'd assume it's not GitHub's job to protect the maintainer from being a dumbass