Question

Is it considered good practice to store passwords in a Github private repository?

[Related to, but very different from, this question]

Answer 1

I’d like to break this question into two parts:

• Is it a good practice to store passwords in source control? No. Credentials are not versioned in the same way. For example, you should be able to change your password without releasing a new build of your software.
• Is it a good practice to store passwords in the cloud? That’s really up to your tolerance for security and reliability. In this case, you’re outsourcing both to GitHub. If GitHub loses your data, do you have a backup elsewhere? If GitHub gets hacked (e.g. your private repo briefly becomes public) or if they don’t securely destroy old drives, what’s the impact if an unauthorized person has your credentials?

Also, when you store credentials, encrypt them and store the key elsewhere.