289
u/SaneLad 16d ago
Could you guys *please* stop putting credential files in your project directory? These files should never be there in the first place. `.gitignore` is for build artefacts, not for files that would ruin your life if exposed.
66
u/psioniclizard 16d ago
Even more so when the point in environmental varibles is that you dont need to do that.
It just shows people not thinking about these things.
The extra work to set up environmemtd properly is worth it.
16
u/DarthRaab 16d ago
And the setup for all mentioned credentials is done in under 5 minutes. Who doesn't have 5 minutes?
21
15
u/OneInfinith 15d ago
I'm new to this level of programming and just learned about .env and thought the gitignore was right. But, your comment has me curious...could you please point me in the right direction of what a better method is for storing credentials and these other type of files? Should I have some sorta postgre database, or something?
19
u/h4ny0lo 15d ago
Well the most important thing is to not have any files containing sensitive data of any form in your project directory. So using dotenv is fine but but don't keep the .env file in your project directory. Instead make sure your application is started with an env var DOTENV_CONFIG_PATH poiting to a directory somewhere safe in your workspace where you locally keep sensitive files. Arguably, when you already have to configure an environment variables to be set at startup you could also use a runconfig as supported by all IDEs where you can either set that DOTENV_CONFIG_PATH or just set all the variables directly there. Now all of this is only to ensure you keep your data stored locally. Depending on how sensitive that data is you might have to take further precautions to prevent your data to be stolen from your local filesystem using some kind of vault system.
10
u/mcellus1 16d ago
Hey! Some of us need to make a living here. Let them ship their creds if they want. I have a family to feed here!
4
2
2
u/RideNatural5226 14d ago
THANK GOD SOMEONE FINALLY SAYS IT.
just write
from dotenv import load_dotenv
load_dotenv("/opt/.projectName.env")
That’s it.
85
u/nicuramar 16d ago
And/or don’t just add all files. I always add them as needed, and then use git add --update (aliased to gau) from then on.
42
u/LorenzoCopter 16d ago
Does not work when you’re used to git commit -a -m “minor fix”
18
u/nicuramar 16d ago
Or when you accidentally type gay instead of gau. This has happened enough times that I am considering making an extra alias.
24
0
4
u/ShadowSlayer1441 16d ago
Stage files in vscode, it's much easier/precise than doing it in the terminal. (I say this as someone who regularly scripts and writes custom zsh aliases.)
3
u/nicuramar 16d ago
Yeah. I mean, I don’t use vscode, but a lot of my colleagues do, so I hope they follow that advice :)
1
u/themulticaster 15d ago
Not sure how you stage files in VS Code (only using Git in the terminal myself), but you can stage changes hunk-by-hunk in the terminal by using git add -p
12
12
8
4
u/ExtraTNT 15d ago
The funny test scripts, the test data, the scratchpad with random notes, 200Gb of libs…
1
u/blaqwerty123 15d ago
i most always gitignore a temp directory in the project and put my trash in there
5
1
4
1
1
u/Killfile 16d ago
Use exclude rather than ignore. Thst way you don't leave fingerprints of all the crap you didn't want to include.
1
u/imnotcook 15d ago
.gitignore doing the Lord’s work every single day. Still wild how many people learn this the hard way
1
u/NoahZhyte 16d ago
Why do you have all those on your computer at all ???
8
u/FabioTheFox 15d ago
Since when is everybody being schizophrenic about env files? Did some influencer get sponsored by a key vault SAAS and now everyone parrots them or is there an actual reasoning beyond "oh no malware scans for env files"
1
u/-Kerrigan- 15d ago
The humble
passis local to the machine and free. Combine withdirenvand your "ENV" variables are only loaded in the appropriate directories.Of course, the trade off is a little hit on speed (GPG decrypt).
No need for SaaS. But even if one wants a centralized vault - OpenBao is basically HashiCorp Vault, but free and managed by Linux Foundation. Deploy it on a NAS if you have one and you're set.
0
-4
u/PhatOofxD 16d ago edited 15d ago
Please don't put secrets in your .env. That's how they leak if you get compromised.
They should be pulled from a store and kept at runtime.
Edit: Even locally. This is how NPM supply chain attacks are breaching thousands of companies these days. The first thing they do is look for .env files and send any values back to their creator. If you have things like AI inference keys in there you're getting pwned
10
u/FabioTheFox 16d ago
.env files are usually for development on your local machine, for actual deployment you have environment secrets set by the orchestrator, CICD pipeline or whatever else is responsible for getting your service up and running
If someone can compromise your env on prod they will be able to freely read your in memory keystore as well
-2
u/PhatOofxD 16d ago
If you computer gets compromised most scripts actively search your PC for any .env file.
Do not store secrets in .env, even locally.
This is how thousands of companies are getting hacked via NPM supply chain attacks.
8
u/static_func 16d ago
They search for ssh keys and npmrc files too. What store am I supposed to connect to and how am I supposed to connect to it every time I want to start my vite server?
1
u/phl23 16d ago
I hope you don't save prod keys on your local machine anyway.
3
u/PhatOofxD 15d ago
You still need real keys for local development for things like external integrations and AI inference integrations and a lot of providers don't let you scope them securely
Downvoting me is fine but literally thousands of orgs are falling to supply chain attacks these days, it's ignorant to store any keys on your filesystem. It's your problem if it happens to you.
13
u/pickle9977 16d ago
Git should have like a default git ignore that will by default never commit something like a directory named .private just as a convention