Comment on Rails 4.1.0 releasedparentComments−joevandyk12yI keep secrets in the DB. Only thing in the ENV that matters is DATABASE_URL. I'm surprised more people don't do this.−nfm12yI like this approach but there is a trade-off - you're an SQL injection away from losing your secrets, as opposed to a RCE or file reading bug when they're stored in .env. SQL injection bugs are more likely.−midas00712yWe use figaro and have a table called variables that overrides the former. Also, we can restart the app from itself and see log files live.
Comments
I keep secrets in the DB. Only thing in the ENV that matters is DATABASE_URL. I'm surprised more people don't do this.
I like this approach but there is a trade-off - you're an SQL injection away from losing your secrets, as opposed to a RCE or file reading bug when they're stored in .env. SQL injection bugs are more likely.
We use figaro and have a table called variables that overrides the former. Also, we can restart the app from itself and see log files live.