“Never check secrets into source control” is one of those
rules that are 100%
correct, until it’s not. There are no universal laws in software, and recently
I had a reason to break this one. I checked AWS keys into a Git repository. I
then pushed those commits to a
public repository on GitHub. I did this
intentionally, and lived to tell the tale. You almost certainly should
never do this, so I thought I would share what happens when you do.
I can imagine you thinking: “this guy posted his AWS credentials on purpose? He
must be an idiot.” I don’t disagree with your conclusion, but just let me