Безопасность5 мин чтения
Where to put secrets on an application server
API keys, database passwords and tokens do not belong in your repository. Where they go instead, and why the distinction is not pedantry.
Эта статья пока на английском. Мы её переводим.
The most common way a credential leaks is not an attack. It is a repository that was private when the key went in and public when somebody forked it, and by then the key is in the history rather than the file.
Environment variables, not files in the repo
The Startup tab carries environment variables, which are set on the container and never written into your code. Your application reads them the way it already does - process.env, os.environ, getenv - and the value exists on the server rather than in the thing you push.
- Database passwords, which the panel generates per database anyway.
- API keys and webhook URLs. A webhook URL is a credential: anybody holding it can post as you.
- Bot tokens, which are the single most leaked secret in this industry.
- Anything you would not print on a billboard.
If it has already been committed
Rotate it. Deleting the line and pushing again does not help - the old commit still has it, and anyone who cloned the repository has it too. Rotation is the only fix, and it is cheap compared to finding out the hard way.
A secret that has been in a public repository for five minutes is a public secret. Scrapers are faster than you are.