Content: Password Management for #8

[JosephTLucas]

Closes #8

[agriyakhetarpal]

Thanks, @JosephTLucas! I feel we should also leave a link to Scientific Python's SPEC 6 – Keys to the Castle here, as a part of it also addresses a similar topic. What do you think?

[agriyakhetarpal]

Suggested change

	1. **Never store passwords or tokens directly in your repository.** Use something like GitHub Secrets to manage your secrets during CI/CD.
	1. **Never store passwords or tokens directly in your repository.** Use secrets on GitHub or similar tooling to manage your secrets during CI/CD.

"GitHub Secrets" makes me feel as if it's an official product/service offered by GitHub to manage secrets, and it doesn't show up as such on search engines, so it could be misleading – I'm curious to hear your thoughts.

[JosephTLucas]

Good point, I can clarify with "secrets in GitHub Actions"

[agriyakhetarpal]

I think we should also mention that GitHub also has its secret scanning service, which is available for free for public repositories: https://docs.github.com/en/code-security/secret-scanning/enabling-secret-scanning-features (and paid for private repositories).

The last time I checked, it used to be enabled by default – I'm a bit surprised that's no longer the case (or I'm misremembering).

[JosephTLucas]

Thanks, @JosephTLucas! I feel we should also leave a link to Scientific Python's SPEC 6 – Keys to the Castle here, as a part of it also addresses a similar topic. What do you think?

Great idea. Do you have some specific context you want to add? If so, feel free to add it directly.

Great review by the way, thank you! I appreciate it.

[agriyakhetarpal]

I feel we should also leave a link to Scientific Python's SPEC 6 – Keys to the Castle here, as a part of it also addresses a similar topic. What do you think?

Great idea. Do you have some specific context you want to add? If so, feel free to add it directly.

Great review by the way, thank you! I appreciate it.

Thank you, the pleasure is all mine! I'll have to think about any additional context to include here, as that SPEC was geared more towards general security practice(s) of managing project-specific resources and not password management in specific. Maybe just a link to it in the conclusion would be alright as a resource for extra reading? I'll push a commit to add it.

[reshamas]

Reminder for me: will add list of examples of accounts for password manager.

For example 1Password has an option for various "vaults", such as "social-media". This permits specific maintainers to access specific vaults.