2025-03-23 Sun

• GitHub

  • #Filed
    • GitHub/Docs/Authentication/Account security/Manage personal access tokens
      • GitHub recommends that you use GitHub Fine-Grained PATs instead of GitHub Personal Access Token (Classic) whenever possible.
      • GitHub Fine-Grained PAT
      • GitHub PAT (Classic)

• Secrets Management

  • 1Password/Browser Extension/How To/Ignore Site from Auto Save

  • Security/Quest/Zero Secrets on Disk

    • Resumed 1Password/Dev/How To/Replace .env secrets with op refs/Q/Can mise wrap op run
      • Reviewed mise/GitHub/Issue/24/02/Struggles with integrating 1Password op in greater detail while trying to use
        • #Discovered that the poster Person/Randy Syring uses or developed level12/GitHub/env-config which isn't what I want

          • env-config (EC) helps manage environment variables in the active shell as defined by an env-config.yaml configuration file. It has built-in support for reading secrets from 1Password.
            

      • #Filed
        • 1Password/Dev/Doc/Guide/Load Secrets/Into Scripts lists four options for loading secrets into scripts
          • My Note - #Important - while this page recommends using service accounts over using 1Password/Dev/op, only some people can use them
          • 1Password/Dev/CLI/Shell Plugin

            • • Summary

                • With 1Password Shell Plugins, you can configure 1Password to securely authenticate third-party CLIs with your fingerprint, Apple Watch, or system authentication. Your CLI credentials are stored in your 1Password account, so you never have to manually enter your credentials or store them in plaintext.
                • You can test shell plugins or choose a shell plugin from the list below to get started.
      • #Updated
        • 1Password Service Account

          • • Important limitations

              • While it sounds like a great idea, and 1P recommends Service Accounts over using 1Password/Dev/op, it's not available to all users or teams and has important use cases that aren't covered yet

              • Not a default feature of 1Password

                • According to 1Password/Dev/Doc/service-accounts/Manage/creating service accounts, only 1Password/Business admins can enable a group to create and manage service accounts. So you can use service accounts if you are a 1Password/Teams admin or if you in a 1Password Business setting in a Group that can create service accounts. 1Password/Family doesn't have any ability to use service accounts.
                  • • 1Password/Dev/Doc/service-accounts/Manage/creating service accounts
                      • By default, only owners and administrators can create and manage service accounts in 1Password/Teams and 1Password/Business.
                      • To allow other groups to create service accounts, an owner or administrator can allow certain 1Password/Business/Groups to be able to manage service accounts.
                  • to fully embrace Security/Service Accounts with fine-grained permissions, a team would need to create many service users, preferably with short-lived access credentials.

              • Can't programmatically delete short-lived service accounts

                • 1Password/Slack/cli message here from Vladyslav Ponoiko

                  • My issue mainly appears because I need to use SA tokens, which I usually generate before run of a particular script and they're aimed onto liveness of max 1 day.
                    Today I run into error when tried to create SA, so cleaned up couple of SA's and this worked, but I would love to get more consistent onto the 'cleaning up' part, as I have lots of SA's by now, and would really love to keep my way of doing things
                    

                  • response from 1Password jr software developer Person/Eddy Filip says that 1Password/Dev/CLI doesn't enable deleting service accounts for the short-lived case

                    • currently the CLI doesn’t provide a programmatic way of deleting service accounts (either active or expired).
                      The only way you can delete service accounts is through the browser. The expired service accounts will be grayed out and will also show with red that they are expired.
                      In the meantime, I will file an issue internally with the request of adding support for deleting service accounts via the CLI.
                      

                  • the conversation also references Service account management · Issue #115 · 1Password/onepassword-sdk-js