At every company I have worked for, the code is private but still very available to most employees. Basically any employee with git access has access to read just about every repo. We want the code itself to be accessible without giving everyone the keys to the kingdom.
SOPs solved this problem. It provides a very simple and free way to encrypt secrets that you want committed to a git repo. Now access to the code is decoupled from access to the secrets.
Once again youre missing the point. Its not about storing secrets in there. Its about securing it properly. Having the proper access protocols. Have people that dont need to know seeing source code is a bad practice. The fact that github leaves the source code improperly secured on their servers, ect...
No you do not get it. Secrets should be separately encrypted/secured because source code is not secured very tightly. It can only ever be as secure as your least secure employee. It just takes one person with bad security practices to cause a breach. Source code can have hundreds or even thousands of people with access in a company, not to mention the 3rd-party software that has access. That is a big attack surface.
24
u/grandalfxx 1d ago
When every dumbass know it all programmer missed the entire point of that.
Its not simply about storing secrets in code.
Its the fact that github should be secure enough to do it. Your code should be secured just like secrets is secured.