Git · Senior · Question 51 of 76

How are credentials best handled for HTTPS remotes?

1Embedding the token in the remote URL in .git/config
✓Correct answer: A credential helper or tokens, never passwords in the URL
3Storing the password in an environment variable named GIT_PASS

Explanation

Tokens in URLs leak into logs, shell history and screenshots. Credential helpers use the OS keychain; CI should use short-lived, scoped tokens.

Further reading

Test yourself

Take the Git · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.