When you push .env to Git #developermemes #softwareengineer #coding

[skysorcerer]

Pushing .env to git is the equivalent of a celebrity having a wardrobe malfunction

[adityag]

For the beginners who didn't understand it. He made a big mistake sharing his API key in a repository which is public and can be accessed and used by anyone, leading to increased billing. Please correct me if i'm wrong.

[navi]

and here I was expecting a short on how to remove commits xDDD

[lordvaders]

Git reset soft -> edit gitignore ->git commit -> git push force

[manosmakris]

Make a .example.env with dummy information, then after you git clone the repo copy the .example.env to the actual .env and fill the actual information. Then add the .env in your .gitignore so that it doesn't get commited in commits at later time. I hope this help.

[learning_trespasser]

deleting repository is the best choice 😂

[jon]

Depends, sometimes you can just cycle keys before anything bad happens.

[nascentone]

I pushed node modules yesterday and it made me feel dumb first time in 2 yrs of coding.

[antonyjr.devlogs]

We use a keyvault and the developer simply has to run az login, thats it, no chance of a apikey leak, unless they write those keyvault response to a file and commit it.

[matthewtalbot-paine]

Yeah but have you ever run a sql update without a where clause. In 20 years I've done it twice

[escape-from-scrum]

If you have any repo forks, you must delete all of them to remove the api key commit

[themanydrippedgod]

Man after fumbling like that, I'm doing leetcode questions to prep for my McDonalds interview

[darnaram]

I did push the .env file onec and bcz of that we had to overhaul all the stuff😂

[solidwaterslayer]

If someone forks that repo, that API key is on the internet forever lol

[SXsoft]

Hmmm I use a small little tool named "git blame" and the magic thing about git is unless you actually overwrite the git history it's still there

[nazobanaguska]

Deleting a repo doesn't make it disappear forever...

[__mrmino__]

Deleting a repo or privating it doesn't do jack squat on GitHub. If someone made a fork or is able to get the commit SHA from e.g. CI logs, you're toast.

Rotate the API key first, then add a comment to the file, that this key is an example and should be replaced. You gonna annoy people who scan for them and ensure that your repo gets ignored in future scan results, if you fat finger this again.

[-na-nomad]

Don't store your api keys in the same directory as your project.

[ApexPlayground_divine]

Git rm file, add the file to git ignore, push only git ignore file👍

[dominicvinciulla]

I was publishing my first personal project to my github and literally just left an API key in my code as a variable