Content: Password Management for #8

[JosephTLucas]

Closes #8

[agriyakhetarpal]

Thanks, @JosephTLucas! I feel we should also leave a link to Scientific Python's SPEC 6 – Keys to the Castle here, as a part of it also addresses a similar topic. What do you think?

[agriyakhetarpal]

Suggested change

	1. **Never store passwords or tokens directly in your repository.** Use something like GitHub Secrets to manage your secrets during CI/CD.
	1. **Never store passwords or tokens directly in your repository.** Use secrets on GitHub or similar tooling to manage your secrets during CI/CD.

"GitHub Secrets" makes me feel as if it's an official product/service offered by GitHub to manage secrets, and it doesn't show up as such on search engines, so it could be misleading – I'm curious to hear your thoughts.

[JosephTLucas]

Good point, I can clarify with "secrets in GitHub Actions"

[agriyakhetarpal]

I think we should also mention that GitHub also has its secret scanning service, which is available for free for public repositories: https://docs.github.com/en/code-security/secret-scanning/enabling-secret-scanning-features (and paid for private repositories).

The last time I checked, it used to be enabled by default – I'm a bit surprised that's no longer the case (or I'm misremembering).

[JosephTLucas]

Thanks, @JosephTLucas! I feel we should also leave a link to Scientific Python's SPEC 6 – Keys to the Castle here, as a part of it also addresses a similar topic. What do you think?

Great idea. Do you have some specific context you want to add? If so, feel free to add it directly.

Great review by the way, thank you! I appreciate it.

[agriyakhetarpal]

I feel we should also leave a link to Scientific Python's SPEC 6 – Keys to the Castle here, as a part of it also addresses a similar topic. What do you think?

Great idea. Do you have some specific context you want to add? If so, feel free to add it directly.

Great review by the way, thank you! I appreciate it.

Thank you, the pleasure is all mine! I'll have to think about any additional context to include here, as that SPEC was geared more towards general security practice(s) of managing project-specific resources and not password management in specific. Maybe just a link to it in the conclusion would be alright as a resource for extra reading? I'll push a commit to add it.

[reshamas]

Reminder for me: will add list of examples of accounts for password manager.

For example 1Password has an option for various "vaults", such as "social-media". This permits specific maintainers to access specific vaults.

[BARRYPMARSHALL]

Hi! I noticed you are looking for security scanning help.

I run FREE33 — a free-to-try microservices platform with 11 services including:

• Code Review — 11 languages (Python, JS, TS, Go, Rust, Java, Ruby, PHP, C/C++), ruff + eslint
• Security Scanning — secrets, API keys, SQLi, XSS, credential leakage
• WASM Compiler, JSON Validator, Diff Engine, API Mocker, and more

All services offer free trials, no signup required. Micro-credit pricing starts at 0.0003 cr per call.

Live endpoint: https://ref-used-out-alliance.trycloudflare.com
GitHub repo: https://github.com/BARRYPMARSHALL/free33

Let me know if FREE33 can help — happy to walk you through integration!