Myth-Busting SOP: 'It's a Private Repo, So Hardcoded Keys Are Fine'

Myth-Busting SOP: 'It's a Private Repo, So Hardcoded Keys Are Fine'

Private today, leaked tomorrow — forked, misconfigured public, or pulled by a compromised contributor. Git history keeps secrets forever. Fix it:

— Step 1: Move all keys, DB creds, and salts to .env; never commit it.
— Step 2: Scan history with gitleaks or trufflehog: gitleaks detect --source .
— Step 3: For any hit, rotate the secret immediately — assume it's burned.
— Step 4: Purge from history with git filter-repo, then force-push and notify collaborators.
— Step 5: Add a pre-commit hook that blocks commits containing key patterns.

Privacy of a repo is not secrecy of its contents. Run this every time.