Vfrdtyky

I did ask a few devs on how do they ensure that keys and credentials files aren't pushed. They did give me few answers, but I didn't find anything consistent.
Lets say there is a creds.json file in /config folder. What are the efficient ways to NOT push these credentials to Github.

Few of the answers I found online :

• Add them to .gitignore


• Store keys separately inside the host machine or different folder


• Just be cautious

Blogs I read :

https://www.agwa.name/projects/git-crypt/

https://blog.roundingpegs.com/how-i-avoid-committing-passwords-to-github/

Is there any tool or a more efficient way such that I don't commit my keys accidentally to Github or warn me before I commit?

I would like you to give a summary of all the possible ways in which you can prevent keys from going to github. Examples to support your summary would be great.

I prefer storing them separately inside the host machine or a different folder and use them over an environment variable. Like that you have you cannot commit them accidentally.

Additionally you can use them in CI build. If you also need credential in CI build most systems provide encrypted variables which are stored encrypted on the build server and can be used as environment variables.

Like that I can use also different credentials for each local user or CI without changes in my code.

Of course there is a a better way!

I would suggest you not to store any passwords hard coded in your code because of the risks of it being uploaded to Github or any other public repositories. The better way to do it is to have a keyring/application that can store your passwords in cloud and make them accessible to your application only.

For example, AWS Secrets Manager. I am sure there are other applications that can do so but this is the one I would recommend. With this tool, you can manage your passwords, rotate your passwords and API keys without being worried about the keys getting uploaded to the public repo's. After storing it here, you need to have a secret manager in your code that will fetch the password and use it in the application.

Also these are some of the other options:

1. Keeping API Key's in database and loading it from there


2. .ini file or .conf file or .env file which are kept in /etc folders


3. AWS Secrets Manager, of course

I also found promising answers here: https://medium.com/slalom-technology/secret-management-architectures-finding-the-balance-between-security-and-complexity-9e56f2078e54

It looks like git-secrets does exactly what you are asking for.

You can have a separate project / package that contains your environment specific configuration, including your secrets.

The secrets are encrypted with a private key, that only authorized persons would have.

When installing your package, you will need the private key to decrypt the secrets on te target machine, that could be done by a ops /dev-ops with access to the private key.

In that way, you can safely push your encrypted secrets to github or any insecured environment.

Alternatively, you can look at https://www.agwa.name/projects/git-crypt/ that allows you to have encrypted files, but I still prefer to have a separate package for the secrets, as you would need different secrets per environment (UAT, prod etc).

Or you could encrypt your whole repo https://github.com/spwhitton/git-remote-gcrypt but you would lose your hosted environment features such as browse commit history etc.

You can use some industry standard tools like Hashicorp's vault "https://www.vaultproject.io/" to store the secrets and retrieve them when required. Lot of big gaints use this tool to manage their secrets. You have to install vault in your organization's environment to access vault. You can refer to this article

"https://www.digitalocean.com/community/tutorials/how-to-securely-manage-secrets-with-hashicorp-vault-on-ubuntu-16-04" on how to install and access secrets from vault. It is PCI complaint and can be used to store very sensitive information. Fortunately there is a library from spring which you can use to easily read secrets from vault. Refer this page for sample code and more "https://projects.spring.io/spring-vault/".

On the other hand there is an offering from Amazon web services called secrets manager. If you organization is using AWS and your apps are hosted in AWS environment it is quite easy for you to put secrets in secret's manager and access them. But secrets manager is not PCI complaint yet and is expected to be PCI complaint in the next upcoming months. Please refer to this video "https://www.youtube.com/watch?v=HiY2oxR1Jd0" on how to use secret's manager in your application.

Hope this helps you. Cheers !!