# Ooops ! I just pushed my unencrypted vault/secets file to the Git repo...

**URL:** <https://forum.ansible.com/t/ooops-i-just-pushed-my-unencrypted-vault-secets-file-to-the-git-repo/17354>\
**Category:** Ansible Developer\
**Created:** [January 22, 2015, 3:44pm UTC](https://forum.ansible.com/t/ooops-i-just-pushed-my-unencrypted-vault-secets-file-to-the-git-repo/17354 "2015-01-22T15:44:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maxime\_Levesque](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@Maxime\_Levesque](https://forum.ansible.com/u/Maxime_Levesque)\
**Post date:** [January 22, 2015, 3:44pm UTC](https://forum.ansible.com/t/ooops-i-just-pushed-my-unencrypted-vault-secets-file-to-the-git-repo/17354/1 "2015-01-22T15:44:38Z")

</div>

Hello everyone, I had opened this “feature suggestion” issue :

[https://github.com/ansible/ansible/issues/9990](https://github.com/ansible/ansible/issues/9990)

And Toshio suggested I discuss it in the mailing list, so here I to :

The problem :

It is easy to add an unencrypted vault file to the Git index before commiting. The nature of Git will cause the secrets to be in the repo “forever”, unless a git rest + git force push is done.

A solution :

Have a switch to cause the naming of encrypted files to have different name (ex. append a suffix) than that of the clear YAML file,  
so that the clear file can be added to .gitignore

This sounds like the simplest solution, but maybe there is a simpler way that could work without requiring changes/feature to the current ansible version.

Thanks for reading !

---

<div class="post-metadata">

**Author:** ![Henry\_Finucane](https://avatars.discourse-cdn.com/v4/letter/h/94ad74/32.png) [@Henry\_Finucane](https://forum.ansible.com/u/Henry_Finucane)\
**Post date:** [January 22, 2015, 4:33pm UTC](https://forum.ansible.com/t/ooops-i-just-pushed-my-unencrypted-vault-secets-file-to-the-git-repo/17354/2 "2015-01-22T16:33:10Z")

</div>

I solved this problem with a naming convention, and a git hook that  
rejected files with that naming convention that were unencrypted (it's  
pretty easy to tell- even when encrypted, they're still plain text,  
and there's a header.)

---

<div class="post-metadata">

**Author:** ![Maxime\_Levesque](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@Maxime\_Levesque](https://forum.ansible.com/u/Maxime_Levesque)\
**Post date:** [January 22, 2015, 4:35pm UTC](https://forum.ansible.com/t/ooops-i-just-pushed-my-unencrypted-vault-secets-file-to-the-git-repo/17354/3 "2015-01-22T16:35:39Z")

</div>

Cool, would you mind sharing your git hook config/code ?