Hide config from version control about scribejs HOT 4 CLOSED

I am not sure what the question is...

The OAUTH Token of GH actually cannot be committed to GH. If you do, GH realizes that and will immediately invalidate the key (it happened to me once). That is one of the reasons why I had to have a config file (~/.scribejs.json or CGI-Executable/.scribe.json) that is never on the Web and can carry the Key.

from scribejs.

Oh I am sorry, I get it. But the config file in the test directory does NOT include the GH Token. And it cannot, see #10 (comment). On the other hand, it is useful if others want to test it.

from scribejs.

@iherman:

“But the config file in the test directory does NOT include the GH Token.”

It might, at some point.
Or other sensitive info, like local paths or hostnames, username/password for our CVS server, a developer key for the W3C API…

It's good practice to exclude configuration and all particulars from version control, imho. They vary from user to user. And apart from the security concerns, changes in config files add noise to the Git history.

“And it cannot, see #10 (comment).”

It's kind of funny GitHub is catching its own tokens inside attempted commits and aborting them… I guess it's a nice feature, but we should not rely on that.

from scribejs.

Ok. I have removed the example config files.

from scribejs.