Leaking secrets

[jimgit]

Description

[Enter feedback here]In VISUAL STUDIO - if you forget to use a git ignore file or accidentally use one for a different type project (like python) and publsih your project to a PUBLIC github repo (you own github) - you will be leaking secrets via the environment variables.

YOU SHOULD PATCH THIS PROCESS SO THIS CAN'T HAPPEN - especially to novice programmers that don't know better.

Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/app-secrets?view=aspnetcore-9.0&tabs=windows

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/app-secrets.md

Document ID

ba688ac2-e90e-fce5-f60d-40c2553c3efd

Article author

@tdykstra

Metadata

• ID: 9c99993c-c983-6fda-6c3a-ce4ec8c1d5db
• Service: aspnet-core
• Sub-service: security

Related Issues

[Rick-Anderson]

Description

[Enter feedback here]In VISUAL STUDIO - if you forget to use a git ignore file or accidentally use one for a different type project (like python) and publish your project to a PUBLIC github repo (you own github) - you will be leaking secrets via the environment variables.

Environment variables are NOT checked into GitHub

[Rick-Anderson]

@tdykstra unless @jimgit can show where .gitignore should be added to prevent leaking secrets, close this issue and not-reproduced

[jimgit]

To reproduce. Use visual studio WITHOUT a gitignore (or an improper git ignore). Since gitignore is a "Hidden" file and may not be understood by a beginner (and you want people to use your tools right?) Create repo in GITHUB (owned by microsoft) - and add the remote (per the instructions if you make a repo with no ignore nor a readme.md) - and now add the remote. What you will find is all types of secrets are leaked to a PUBLIC repo. This is a "FEATURE" of Visual Studio and Github when used by an ametuer. WHY do you think you have scanning tools that alert due to secret leaks?

…

On Tue, Jan 14, 2025 at 4:19 PM Rick Anderson ***@***.***> wrote: @tdykstra <https://github.com/tdykstra> unless @jimgit <https://github.com/jimgit> can show where .gitignore should be added to prevent leaking secrets, close this issue and not-reproduced — Reply to this email directly, view it on GitHub <#34462 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVHFJM4ETWL3EXWFPMESD2KWEPNAVCNFSM6AAAAABU7DU3ZGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKOJRGIZDCMJSGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- Jim Kennelly THE-E-OFFICE (219) 741-7304