alt Hacker News> Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
One of the first things I did in my last job was shift processes like this off my team's computers, aside from the security ramifications all it takes is one dumb mistake, one up-arrow too many, one didn't-read-the-whole-line, and now you're doing something to production by accident!
Replies
What sorts of processes related to secret storage were you able to shift off of team computers? From my perspective, if I need to get e.g. an API key from Twitter and put it into my prod environment, i have to be doing that with my computer somehow. There's still millions of different types of secrets that need meat puppets to shuffle them around.
TBH CI does not prevent this kind of mistakes. I've seen people triggering the wrong CI pipeline.
I also did that, for a team deploying smart contract on chain from local.
It took a couple months to get the pipeline out of their laptop.
Worth it, yes, as we found interesting things in there which explained why they were so reluctant to deploy upgrades.