GitHub is brilliant…. There are loads of tutorials, video and articles out there, recently I’ve spent time filling gaps in my Git version control knowledge and something struck me as odd. Every tutorial should make it clear right from the start and reminders throughout their presentations that you
DO NOT STORE PASSWORDS, KEYS, USERNAMES, CREDENTIALS, ETC. ON GIT HUB
Why?
Because there are bastards out there who are scanning git repositories for anything that could help access secured areas or consume resources they should not.
Git does scan your repo’s and will warn you but its not in real time so be warned. Still not convinced? The image is of a free Amazon Web Service account that was set up as a learning exercise the keys where saved in a Git Repo and over the course of 3 days a free account had racked up nearly $10,000US .
What can you do, if you accidentally commit a password, key, etc? Delete the branch? Roll back?
No!
The best advice and this is also given by Git themselves is to consider your data compromised and your accounts that use the data hacked. Once again, rolling back and deleting does not work.
So reset your passwords/key etc and don’t just add a 1 at the end or swap out vowels for 12345.
How do you manage password and environment values?
Have a Google for git .gitignore or visit dotIgnore on GitHub