Hacker News Reader

Are you associated with Doppler?

You have been linking it multiple times in this thread, and this comment sounds like a sales pitch.

Yes I am. More people need to know secrets managers exist. Doesn't have to be Doppler - but they should be used more often.

Are you by chance affiliated with the secrets manager solution you've attempted to promote a fair few times in this thread?

Yes- More people need to know secrets managers exist and the types of problems they solve. I'm passionate about helping people discover and understand what secrets managers do. Using any secrets manager would be better than none at all - it does not need to be our solution as there are plenty to consider.

> Your source code repo should never contain secrets like API keys.

Why not?

1) Because exactly this happens

2) Because developers check out that source code and store it on their own laptops, which can sometimes get lost, stolen, or hacked.

3) Because with a proper secrets manager, each developer can get their own auth credentials for each service, increasing auditability.

Ask Mercedes-Benz. If somehow that repo gets exposed - so are all of your secrets. You just made a problem a lot worse and potentially opened up an avenue to expose more data.