0
316
Viewsgithub copilot giving away API keys? how can I protect my keys?
I have installed and used github copilot for some time. And while working on a google maps project, I was curious and asked it to autocomplete the API url with the key open, and it listed suggestions with various API keys included. This got me worried since it generates codes based on other people code on github.
At first I was thinking those could be not functional keys, But I found that to be wrong based on this article.
So, how what methods can I use to protect my keys from such happening? I am thinking uninstalling wont help since my repos are already at github.
1 answers
Answer question0
The only way to protect yourself is to not commit any private information to a public git repository.
Your Google Maps API key should be stored in an environment variable or a configuration file, and should never be checked into git.
A common way to do this for modern applications is to use environment variables in production and a .env file in development (that simulates using environment variables but actually holds the content of those variables in a local file). There are "dotenv" libraries available for just about every programming language. You will typically also create a .env.example file which you do commit to git that contains examples of all of the environment variables that your application requires, but does not contain actual secret values.