Skip to main content

Is my repository safe as a public repo?

Yes and no. The password themselves are safe, since they are stored in an encrypted fashion. They are secure as long as your GPG key's secret part is safe. However, the repo leaks the names of the entries: a password named web/site.com will be stored in the file web/site.com.gpg. As a consequence, anyone who can see your public repo can see the name of your passwords, which is not so great for privacy: if a file is named web/pornhub.com.gpg, this might give a hint about your browsing habits. Moreover, the size of the files might also gives a clue about which accounts might have small passwords. If a file is very small, chances are that your password is small too. An attacker could use this information to select which account of yours is most likely to have a weak password.