I'd like to know how these kinds of tools (Copilot included) avoid reading users' secret tokens and passwords.
But knowing how we programmers work and how we treat security collectively, I guess I've already had the answer.
But knowing how we programmers work and how we treat security collectively, I guess I've already had the answer.
I wrote a small utility to do this (https://www.npmjs.com/package/@qnzl/lockbox) and it behaves similar to `pass` by using gpg encryption. I wrote it because I was doing a lot of programming streaming and I kept exposing secrets.
So rather than having a .profile that is:
GITHUB_TOKEN="steal this"
It's
GITHUB_TOKEN=$(lockbox product/dev/githubToken)
Then you `source` it and your secrets are in your environment without putting them into plain-text.
With this specific project, it is running on your local host, so you can sanitize the data before allowing ChatGPT queries to suck it into the "cloud".
Generally speaking, you should not have secrets and tokens in your code in the first place. This specific ChatGPT plugin respects your .gitignore files (unlike CoPilot?). So if you do have some tokens in .env.secrets, but the file is ignored, it wouldn't list that for ChatGPT to read.
But you shouldn't hold tokens in your project in the first place, those belong in the running environment, not in the code.