This document outlines best practices for handling sensitive information such as API keys, private keys, and other secrets in the GitHub Package project.

• NEVER include actual secrets, private keys, or credentials in:

  • Documentation files (README.md, setup guides, etc.)
  • Source code files
  • Comments
  • Example files

• Always use placeholders in documentation, such as:

  GITHUB_APP_ID=your_app_id
  GITHUB_PRIVATE_KEY=your_private_key_content
  GITHUB_INSTALLATION_ID=your_installation_id
  

1. Use .env files for local development

   • Store secrets in .env files for local development
   • Ensure .env files are listed in .gitignore (they are in this project)
   • Consider using .env.example with placeholders as a template

2. Format multi-line secrets properly

   • When storing multi-line secrets like private keys in .env files, replace newlines with \n:

   GITHUB_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\nMIIEpQIBAAKCAQEA...\n-----END RSA PRIVATE KEY-----
   

3. Rotate secrets regularly

   • Rotate GitHub tokens and other credentials periodically
   • Update environment variables after rotation

1. Use environment variables in production

   • Set environment variables directly in your deployment platform
   • Use secrets management services when available:
     • Google Cloud Secret Manager
     • AWS Secrets Manager
     • Azure Key Vault

2. Use service accounts when possible

   • Prefer service accounts over personal credentials
   • Limit permissions to only what's needed

3. Secure CI/CD pipelines

   • Use encrypted secrets in CI/CD pipelines
   • Never log or expose secrets during builds

1. Store private key files securely

   • Keep private key files outside the project directory
   • Use absolute paths to reference them
   • Consider using a secrets manager

2. Format private keys correctly

   • When using private keys in environment variables, ensure proper formatting:
   • Replace all newlines with \n
   • Include the BEGIN and END lines
   • Example:

   GITHUB_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\nMIIE...\n-----END RSA PRIVATE KEY-----
   

1. Monitor for exposed secrets

   • Use tools like GitGuardian or GitHub secret scanning
   • Regularly audit code and documentation

2. If secrets are exposed:

   • Immediately revoke and rotate the exposed credentials
   • Remove the secret from the repository history if possible
   • Document the incident and improve processes

• GitHub Docs: Securing your repository
• OWASP Secrets Management Guide
• Google Cloud: Secret Management Best Practices