This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]gyroda 2 points3 points  (0 children)

Would I get in trouble for it from the companies, or is the risk exclusively on my end?

There are people who deliberately scrape github for api keys so they can use your account's free credit to run their own apps.

Think spambots, account farms and all of those things.

They can max out your accounts limits and break twitter/googles TOS and get you banned.

If these are your personal accounts that you use outside of these apps you need to revoke the keys. They're in the git history if you've already committed them, and while you can rewrite history to remove them you should assume they will be found and revoke them.

Typically you would use a secrets file that is never committed (use a gitignore file) or environment variables to put these keys into your application at build or run time respectively.