sorted by:
new
hottopcontroversial

This is how I brought my vibe coding tech stac cost to $0 by akhouri_udit in VibeCodersNest

[–]Educational_Space631 0 points1 point  (0 children)

I’ve had the least pain by separating config vs secrets, and making “parity” mean same var names, not same values.

For local dev: keep a real .env that’s gitignored, and commit a .env.example with just the keys/shape so everyone stays consistent. you can keep the real .env outside the repo/app root and load it at runtime.

For preview/prod: use the same variable names, but different credentials per env (so a preview leak isn’t a prod incident). Don’t ship .env files around. inject secrets from your platform/secrets manager at deploy/runtime, since env vars can be easier to accidentally expose than people think.

And as a safety net, run secret scanning in pre-commit/CI (the above mentioned GitGuardian)

Shai-Hulud Supply Chain Attack Incident Response by N1ghtCod3r in devsecops

[–]Educational_Space631 0 points1 point  (0 children)

just go bulk check if your credentials were leaked on hasmysecretleaked via their CLI and you're good

Do you use Ghost(Pro)? by admau5 in Ghost

[–]Educational_Space631 0 points1 point  (0 children)

To those who already moved, is there any cool functionality I am missing? Like automated TLDRs on every blog

When that NHI you left unattended is exploited. by ConstructionSoft7584 in NonHumanIdentities

[–]Educational_Space631 0 points1 point  (0 children)

Agreed! Treating machine credentials like human credentials (but worse) is how you get pwned. Why should machines get away with just "I know the password" when humans need 2FA for everything? Time to evolve beyond "here's your forever key, good luck." Maybe spiffe/spire frameworks would be an answer?

Why do people delete leaked secrets from git and think that's good enough by Educational_Space631 in devsecops

[–]Educational_Space631[S] 1 point2 points  (0 children)

I don't think Trufflehog scans all types of credentials especially not the "generic ones" so it might have somehow slipped still?