@[email protected] to [email protected]English • 1 year agoGitHub Copilot, Amazon Code Whisperer emit people's API keyswww.theregister.comexternal-linkmessage-square11fedilinkarrow-up119arrow-down11
arrow-up118arrow-down1external-linkGitHub Copilot, Amazon Code Whisperer emit people's API keyswww.theregister.com@[email protected] to [email protected]English • 1 year agomessage-square11fedilink
minus-square@pixxelkicklinkEnglish3•1 year agoA config file outside of the repository to be specific. On Linux it can go somewhere under ~ On windows it can go somewhere in AppData Ie; ~/YourAppName/Secrets.json or whatever your config file flavor is. Json, yaml, xml, whatevs
minus-square@tmRgwnM9b87eJUPqlinkEnglish1•1 year agoNo. For development purposes I want my devs to be able to clone the repo and start. So the development config files are inside the repositories.
minus-square@DoomBot5linkEnglish0•1 year agoWow, that’s a terrible security process even for development configs. How about adding a script they can run right after cloning to pull the needed keys from a secure location using their own user credentials? Plenty of solutions out there.
minus-square@tmRgwnM9b87eJUPqlinkEnglish0•1 year agoSo let’s say the code base leaks. Let’s say our VPN was also compromised. Then what is the worst that can happen? Some internal dev api with no real data in it can be tested by hackers.
A config file outside of the repository to be specific.
On Linux it can go somewhere under ~
On windows it can go somewhere in AppData
Ie;
~/YourAppName/Secrets.jsonor whatever your config file flavor is. Json, yaml, xml, whatevsNo. For development purposes I want my devs to be able to clone the repo and start.
So the development config files are inside the repositories.
Wow, that’s a terrible security process even for development configs. How about adding a script they can run right after cloning to pull the needed keys from a secure location using their own user credentials? Plenty of solutions out there.
So let’s say the code base leaks.
Let’s say our VPN was also compromised.
Then what is the worst that can happen? Some internal dev api with no real data in it can be tested by hackers.