Or perhaps there is a configuration flaw in your build server which grants everyone on the internet read access to your projects. Even if the service isn’t malicious, thereis the chance that there is a vulnerability in the services that could be exploited to expose the files. Once you’ve enabled access, these services now have permission to read your secrets. However, many teams don’t think twice about allowing third party services to access these private repositories. You might be thinking, “Why should I worry? Our GitHub repository is private, and only our team can access the secrets!”Ī private repository on GitHub or GitLab may seem like a safe storage area, since access is limited to a small set of specified parties. This practice is easily labelled Not Good.
This includes SSH keys, SSL private keys, API keys, passwords, and client secrets. I’ve worked on many projects where sensitive information is stored in a git repository.
0 kommentar(er)
