Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Rule “share-your-developer-secrets-securely/rule” #9564

Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions rules/share-your-developer-secrets-securely/rule.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
---
seoDescription: Do you share your developer secrets securely? Learn how to store and share sensitive information safely, avoiding common pitfalls and implementing best practices for secure development environments.
type: rule
archivedreason:
title: Do you share your developer secrets securely?
guid: 6165deaa-a3b0-40b1-8659-482a34faf7c4
seoDescription: Do you share your developer secrets securely? Learn how to store
and share sensitive information safely, avoiding common pitfalls and
implementing best practices for secure development environments.
uri: share-your-developer-secrets-securely
created: 2023-08-14T00:00:00.0000000Z
authors:
- title: Gordon Beeming
url: https://ssw.com.au/people/gordon-beeming
Expand All @@ -14,8 +13,10 @@ authors:
related:
- store-your-secrets-securely
redirects: []
created: 2023-08-14T00:00:00.000Z
archivedreason: null
guid: 6165deaa-a3b0-40b1-8659-482a34faf7c4
---

Most systems will have variables that need to be stored securely; OpenId shared secret keys, connection strings, and API tokens to name a few.

These secrets **must not** be stored in source control. It is not secure and means they are sitting out in the open, wherever code has been downloaded, for anyone to see.
Expand All @@ -26,6 +27,9 @@ You may be asking what's a secret for a development environment? A developer sec

<!--endintro-->

`youtube: https://www.youtube.com/watch?v=IwvCTwz0C7M`
**Video: Do you share secrets securely | Jeoffrey Fischer (7min)**

An encryption key or sql connection string to a developer's local machine/container is a good example of something that will not always be sensitive for in a development environment, whereas a GitHub PAT token or Azure Storage SAS token would be considered sensitive as it allows access to company-owned resources outside of the local development machine.

### Bad Examples
Expand Down
Loading