Database Secrets: Keep Credentials Out of Repositories
A password committed to a repository may remain in history after the file is removed. This guide gives you a small, testable way to approach the issue before changing a live system.
A practical workflow
- Use a secret store or deployment environment and give the application a narrowly scoped database account.
- Rotate an exposed credential, inspect logs for use and remove it from active configuration.
What to check
A .gitignore rule prevents future accidental additions, but does not erase a secret already committed. Compare the result with the original problem and record what changed. If a measurement or test does not support the change, revisit the assumption rather than adding more complexity.
Keep the experiment small enough to reverse. Document the starting state, the change and the result so another person can repeat the process. Product menus and versions can change, so check the current documentation for your environment.
Official reference: Read the documentation.