Dwayne McDanielSession Video
About this session
“No one wants their keys, passwords, and other secrets exposed. Ideally, no developer would ever hardcode anything like that into their work, but unfortunately, a lot of repos are just one bad push from the world gaining access to sensitive data and mission-critical systems. In the best-case scenario, you discover the issue and fix it before something terrible happens, but in the worse cases, you don’t find out until it is far too late. Just ask folks like Uber or Twitch.
Most devs are familiar with using .env and .gitignore files to help prevent Git from tracking specific files and folders. But did you know that you can leverage git hooks, and some open source awesomeness, to keep from accidentally committing your secrets in the first place?
Walk away from this session with some concrete actions you and your devs can take to make sure no secrets make it into your shared hosted repos ever again!
But that is just the start. If you are not actively using Git hooks in your workflows, then this talk is for you. Let’s look into the .git folder and unlock a whole world of automation possibilities!
My hope with this session is to help everyone add some easy-to-implement automation to their workflows to prevent making more extreme, and costly, kind of mistakes.”
Publication:
https://blog.gitguardian.com/how-to-use-ggshield-to-avoid-hardcoded-secrets-cheat-sheet-included/