Thousands of images on Docker Hub leak auth secrets, private keys - eviltoast
  • andrew@lemmy.stuart.fun
    link
    fedilink
    arrow-up
    9
    ·
    1 year ago

    You’re right in one sense but when you get to the last sentence your argument breaks down.

    The same type of secret should be treated the same way. The problem with treating environments different is that it builds bad habits especially for new devs who come in and see it being done in a certain way. But also, humans screw up and it’s better to just build the habit of not committing anything private outside of prod-like credential stores even if it’s not the prod instance.

    • deejay4am@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      Yeah, exactly. Don’t allow it anywhere, way less chance someone forgets to remove them from the prod build.