How can I upload my application to github but remove sensitive authorization information?

Question

I want to upload my app to github so I can share portions of it for feedback and help...but it contains information used for logging into other services and so forth.

How do I upload it into github without making it difficult to continue to use that repository for deploying into heroku?

See [Using github to host public git repositories whilst ensuring that sensitive data files remain untracked](http://stackoverflow.com/questions/2250040/using-github-to-host-public-git-repositories-whilst-ensuring-that-sensitive-data) — Matthew Flaschen, Jul 11 '10 at 02:51
The suggestion in that thread to keep sensitive info out of the code and stored in environment variables or heroku config variables is especially pertinent. — Sharpie, Jul 11 '10 at 03:07
See also, on a similar topic, http://stackoverflow.com/questions/3207575/how-do-i-open-source-my-rails-apps-without-giving-away-the-apps-secret-keys-and/3207608#3207608 — VonC, Jul 11 '10 at 08:25

score 2 · Accepted Answer · answered Jul 30 '10 at 16:42

2

On Heroku you can use config vars to store configuration information.

http://docs.heroku.com/config-vars

This will keep it out of your repository.

answered Jul 30 '10 at 16:42

David Dollar

2,409
17
18

score 0 · Answer 2 · answered Jul 11 '10 at 15:22

0

If you want to keep your configs stored in the git repo you can use branching. First, make sure the sensitive information is removed from the repo's history. Then you go to your main branch (master) and create a new branch off it called heroku. You put your configs into the heroku branch and keep that branch local. You never push it to github. Whenever you want to deploy, you checkout the heroku branch, merge in the master changes and push to heroku.

answered Jul 11 '10 at 15:22

igorw

27,759
5
78
90

thanks -- how do I remove sensitive information from the history? – Satchel Jul 12 '10 at 12:38
Take a look at interactive rebasing. – igorw Jul 12 '10 at 15:11
Isn't it a bit late if the information is already in the repository? (that is, at least if you've pushed it to the central/public one) – Lasse V. Karlsen Jul 30 '10 at 16:43
it hasn't been pushed into the public one...but even if it were to do a git rm now...it would still be in there in the past commits.... – Satchel Jul 31 '10 at 01:56

score 0 · Answer 3 · answered Sep 07 '10 at 13:02

I found by far the easiest way to handle this is to just change your passwords and API keys. Far easier than scouring your repo and re-writing its history to expunge any sensitive data. Just changing your creds is a much more surefire way. Of course don't commit the new info.

How can I upload my application to github but remove sensitive authorization information?

3 Answers3

Linked