Stop Slacking your secrets. Use GitHub instead.

Three months ago a friend of mine onboarded a contractor. He DM'd him the .env . Standard practice. Two days later the contractor pushed a debug log to a public repo with one of the keys still in it. They rotated. Customers didn't notice. But that file is still in his Slack archive. It's still in the contractor's Slack archive. It's still cached on two computers. It will still be there in five years. That's the .env problem. Most teams "solve" it the same way: Slack DM (plaintext forever, in two