Git and Version Control Security

Understand What Must Never Be Committed

Before setting up any tooling, every developer on the team needs to understand what should never appear in a Git repository. This is the foundation everything else builds on. ### The Secrets That Cause Real Incidents ``` Never commit these to Git: Cloud provider credentials: AWS access key IDs (start with AKIA or ASIA) AWS secret access keys GCP service account JSON files Azure client secrets API tokens: Stripe, Twilio, SendGrid, OpenAI API keys GitHub personal access tokens (start with ghp_) Slack tokens, Discord tokens Any string that looks like a random 32+ character value Database credentials: Database connection strings (postgresql://user:password@host/db) Database passwords Redis connection strings with auth tokens Infrastructure credentials: Private SSH keys (.pem files, id_rsa, id_ed25519) Kubernetes kubeconfig files with cluster credentials Docker registry credentials Vault tokens Configuration files with real values: .env files with actual credentials application.properties with database passwords config.yml with API keys terraform.tfvars with access keys ``` ### The Safe Pattern — .env Files The correct pattern for managing local development secrets is: ```bash # .env — this file contains real credentials, NEVER commit this DATABASE_URL=postgresql://appuser:realpassword@localhost:5432/mydb STRIPE_SECRET_KEY=sk_live_your_real_key_here AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE ``` ```bash # .env.example — this file contains placeholders, SAFE to commit # Copy this file to .env and fill in your values DATABASE_URL=postgresql://user:password@localhost:5432/dbname STRIPE_SECRET_KEY=sk_live_your_stripe_key AWS_ACCESS_KEY_ID=your_aws_access_key_id ``` ```bash # .gitignore — this file blocks .env from ever being tracked .env .env.local .env.*.local *.pem *.key credentials.json service-account.json .aws/credentials kubeconfig ``` The `.env.example` file gets committed so new developers know which variables are required. The `.env` file never gets committed because it is in `.gitignore`. ### What Does Not Work — Common Mistakes ``` Mistake 1: Delete the file and commit again Result: Secret still visible in git log — anyone can run git show <old-commit-hash> and see it Mistake 2: Make the repository private Result: If anyone forked or cloned before, they have the secret Bots may have already scraped it Mistake 3: Use git revert Result: Revert commit shows the old file in the diff Secret is still in the history The only safe response is: 1. Revoke the secret immediately (before doing anything else) 2. Remove it from Git history using git-filter-repo 3. Force push the cleaned history 4. Check access logs for any unauthorized use ``` ---