3

I have some GitHub repositories where I have connection strings to online databases, such as Mongo and Firebase.

I have seen some solutions for this problem. But I would like to know if there was a way to hide a line of code in a specific file, so that others would not be able to see the sensitive data and I would run the risk of losing that data.

Note: I cannot delete the entire file, because there are some important configuration on it, I would like to just "make some lines of code invisible" to others. Is it possible?

Paolo
  • 21,270
  • 6
  • 38
  • 69
Luiz Augusto Ventura
  • 39
  • 1
  • 5
  • Does this answer your question? [git commit config on initial commit but never again?](https://stackoverflow.com/questions/9345839/git-commit-config-on-initial-commit-but-never-again) – phd Dec 20 '19 at 15:41
  • https://stackoverflow.com/search?q=%5Bgit%5D+application+config – phd Dec 20 '19 at 15:41

4 Answers4

4

No, it is not possible and YOU SHOULD NEVER put the credentials and other confidential data into the GitHub plaintext. There is lots of bots scanning through the git and gathering the passwords from there.

It is not possible, because even If You would somehow be able to do this. Someone could simply fork/clone Your repository and would be able to see the data again on their disk.

You should consider switching to a different way of providing credentials to Your applications, like secrets or at least environment variables.

But generally the answer to the question asked is no, because it's not how the git works.

Dominik Wosiński
  • 3,769
  • 1
  • 8
  • 22
  • Yeah, I should have thought about that 1 year ago. Now I have some old repositories with lots of commits. It's gonna be really hard to edit them one by one, removing those lines of sensitive data. Thank you! – Luiz Augusto Ventura Dec 20 '19 at 16:05
  • Yeah, my suggestion is to make the repos private for the time of finding solution, otherwise, if You have the details for Your database connection there, it can easily be hacked. – Dominik Wosiński Dec 20 '19 at 16:12
2

I think that common practice is using environment variables for your connection configuration. This way you can share example .env config file in your repository and keep your passwords etc. for yourself.

How to use environment variables in your app? It depends on technology and environment you are using so its hard to give one solid answer here.

Rafał Cz.
  • 735
  • 9
  • 19
1

I'll add, after repeating the "ffs don't mix secrets in the same dataset with public data" answers above, that Git does allow "smudge" and "clean" filters for data going into and out of the repository, see here for a closely-related question. Sometimes you're stuck with code that still thinks "unobtrusively tucked away" is enough to be made secure and you have to go through gyrations like this.

jthill
  • 55,082
  • 5
  • 77
  • 137
0

What people tend to do is to have a sample file included in the project and set .gitignore to ignore the real files so that they are not included in the project.

So, something like having a file called config.properties.sample with default values, have the application read config.properties and set .gitignore with a line that says config.properties. A new developer sits down, clones, creates the real file from the sample adjusting values and everybody will be happy everafter.

eftshift0
  • 26,375
  • 3
  • 36
  • 60