Moving a PHP Site from Private to Public Repo – Security Concerns
Separate admin code into a private repo and use environment variables to protect credentials.
Separate admin code into a private repo and enforce environment variable usage.
Summary
A developer has a vanilla JS and PHP 8.3 site that uses Cloudflare Turnstile to block bots. The backend is MySQL and the code is stored in a private GitHub repository with .env files for API keys and database credentials. They plan to make the repository public within a year and want to ensure no sensitive data is exposed. They worry that the admin panel and user information might be inadvertently revealed.
The developer asks whether moving the admin panel to a private repo is sufficient to protect user data. They also want to know if any other steps are needed to secure the public codebase. The discussion revolves around best practices for handling secrets, code separation, and CI/CD pipelines. The goal is to maintain security while making the project open source.
Key changes
- Use Cloudflare Turnstile for bot protection
- Backend uses PHP 8.3 and MySQL
- Sensitive data stored in .env
- Private GH repo holds admin panel
- Plan to switch to public repo
- Risk of exposing admin panel and user data
- Consider moving admin to private repo
- Implement CI/CD to enforce secrets