Contents
Why is a bad idea to commit secret data into a Git repository?
In addition to intentionally storing secrets in git, when secrets are not managed properly, it is very easy to lose track of them. Secrets may be hardcoded into source code, stored as text file, shared over Slack or buried inside a debug application log.
Where are user secrets stored?
Your secrets are stored in a JSON file under your user profile. In a Windows machine, they are stored in the %APPDATA%\Microsoft\UserSecrets\\secrets. json file. In a Linux/macOS machine, they are stored in the ~/.
How do I protect my repository code?
- Choose a repository you trust.
- Consider the exposure of your repository.
- Protect access credentials.
- Separate secret credentials from source code.
- Access to the repository should be revoked swiftly when no longer required, or in the event of compromise.
- Include open code in your risk model.
- Review all code changes.
Why is it bad to store passwords on your computer?
3 – Storing your passwords will make your accounts vulnerable to roommates, family members, and visitors who like to snoop around on your computer when you aren’t around. 4 – If you allow your browser to store your passwords that means you won’t be typing them for a while, therefore you’re likely to forget them.
Who is access to the version control system?
Anyone who has access to the version control system has access to that secret. In the example above, every single developer at your company has access to the master credentials for your database. Every computer that has access to the version control system keeps a copy of that secret.
What happens if one of your passwords is compromised?
If any one of your passwords gets compromised, that puts all the accounts where you’ve also used it at risk. Given the increasing number and sophistication of hackers trying to break into your computer, and the increasing number of security breaches that have already happened around the world, this is not as unlikely as it sounds.
What happens if you lose your browser password?
1 – If your computer or mobile device is ever lost or stolen, whoever ends up with possession of it will have immediate and complete access to any online accounts that you have allowed your browser to store the passwords for.