Take the 2-minute tour ×

So im writing code and pushing it to github and pushing it to github etc etc....

Problem is when I do that I am also pushing things like Facebook API keys and config.php encryption keys - anyone know how to push code without doing this?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Just don't include them in your code and use environment variables:

$my_very_secret_key = getenv("MY_VERY_SECRET_KEY");

You'll define this key wherever your webserver will allow you to. For instance with nginx:

env MY_VERY_SECRET_KEY='OhThatsAVerySecretKey'

This procedure is recommended by Heroku to store s3 credentials, it's imho the best way to go.

share|improve this answer
Great idea! thank you :D Btw, how do i do that with Apache? –  lenswipe Jun 25 '12 at 22:43
...nevermind i found it :D httpd.apache.org/docs/2.0/mod/mod_env.html#setenv –  lenswipe Jun 25 '12 at 22:46
add comment

Store your keys in an external file configuration file that you exclude with a project-level .gitignore. If you've already committed your keys, you should remove them from the repository with git-filter-branch(1).

See Also

share|improve this answer
add comment

Your Answer


