Tagged #git

There's a specific kind of stomach drop that comes from realizing your database password is sitting in a public Git repository. Bots scan public repos constantly looking for exactly that, and API keys for cloud providers and payment services are a favorite. This is one of those problems where a few habits up front save you from a really bad day. What counts as a secret Anything that grants access. Database passwords, API keys, OAuth client secrets, private keys, webhook signing secrets, SMTP passwords, encryption keys, the app's session secret. If someone with that string could do something…

Git has a reputation for being confusing, and some of that is earned. The commands are named inconsistently, the error messages assume you already know what went wrong, and there are about four ways to do everything. But the core idea is simple, and you only need a handful of commands to get real value out of it. This is the version I'd hand to someone on their first day. The one idea that matters Git takes snapshots of your project. Each snapshot is called a commit. A commit records what every tracked file looked like at that moment, who made it, when, and a short message explaining why.…