Secrets and Environment Variables

A developer needs the payment provider's API key to test the booking service. They add one line to application.properties and commit it with the rest of their change.

booking.payments.api-key=sk_live_7Qz4Fh2c

The next day a reviewer spots the line, and the developer deletes it in a new commit. The key is still in the repository, because version control keeps every earlier commit. Everyone who can read the repository can read that commit. The only real fix is to cancel the key at the provider and issue a new one.

.....

Like the course? Get enrolled and start learning!

Reading Progress

0%

Vote for new content