Github private repos have been made public by mistake before. Got repos are cloned on dev laptops, do you enforce laptop encryption?
The right thing to do is using some form of a vault.
The right thing to do is using some form of a vault.
Still not optimal as far as security goes, but it seems that he have roughly the same exposure if AWS leaks our keys and passwords to other third party trackers...
Don't initialize into env vars and don't store in repos, even private ones.