Application secret token shouldn't be in source control

jmontross / karmagrove

PLEASE SEE https://github.com/karmagrove/karmagrove.com conscious commerce experiment

https://www.karmagrove.com

3 stars 3 forks source link

Application secret token shouldn't be in source control #86

Closed seanlinsley closed 10 years ago

seanlinsley commented 10 years ago

The secret token used to sign cookies should not be kept in source control (particularly as an open source website), as that means anyone can forge a cookie that your site will believe to be valid. That's a Very Bad Thing :scream_cat:

jmontross commented 10 years ago

Thanks Sean.