Question

I want to make a private Github repo public, but the project includes OAuth data (used in Twitter auth) and database MySQL login details.
Is there a common practise to easily hide the values or shall I just change them when committing to the repo? I guess thats the reason I’m asking as I’m likely to forget.

Answer 1

If you can rewrite the history of your private repo (because of the limited number of collaborators), it would be best to:

• remove completely from the all history those sensitive data
• store them “elsewhere” (ie not in a Git repo but in an external source)
• use content filter driver to manage your actual sensitive file content.
  See “What’s the easiest way to deal with project configuration files?” for instance:

The idea is, on checkout, to generate the actual files based on:

• your environment
• a template file
• a value file (which can be, based on your current environment, dummy values store in a separate value file in your Git repo, or your actual sensitive value stored in your external source outside the Git repo)

The more general idea is that sensitive data shouldn’t be stored at all in a Git repo.