Sublime Forum

Question(security): private variables in .sublime-settings files

#1

1. Summary

I want to push to GitHub content of my Packages/User folder.

Problem — in some .sublime-settings files I have passwords and tokens. I don’t want push them.

Is any method for solve this problem?

2. Example of expected behavior

Templates mechanism as in Grunt:

User/SashaPackage.sublime-settings file.

{
    "password": "<%= passwords.sashapackage.password %>"
}

User/Passwords.yaml:

sashapackage:
  - password: myexamplepassword

User/.gitignore

Passwords.yaml

Results:

  1. User/SashaPackage.sublime-settings file works for local environment,
  2. Passwords stored in User/Passwords.yaml,
  3. I can push User/SashaPackage.sublime-settings, if User/Passwords.yaml was ignored.

Is it possible something like that?

3. Do not offer

  1. Please, do not offer don’t push files with passwords and tokens. In addition to passwords and tokens they can have settings that are of interest to other users.

Thanks.

0 Likes
#2

Ideally, you’d probably want to push to a private repo. Bitbucket and I believe GitLab allow you to create free private repos. You could also pay for private GitHub repos. Unfortunately, I don’t have any good advice for pushing sensitive info to a public repository.

0 Likes
#3

You can ignore your password file via .gitignore. So if your plan is to include your password via template variables and apply after checkout, and then obscure them before push, then you could do that. You’d have to be vigilant and ensure that you never forget to run your obscure script. I guess you could create a commit hook to check if you remembered to obscure passwords. You could have it reject your commit if it detected clear passwords. So I guess it is possible. I don’t know if anyone has a canned solution for you, but I think it is possible to do.

1 Like