September 4, 2026
To store git credentials we would normally do
git config credential.helper store
git push http://example.com/repo.git
Username: *type username*
Password: *type password*>
[several days later]
git push http://example.com/repo.git
[credentials are used automatically]
The problem is
That creates an unencrypted file with the credentials. The ~/.git-credentials is an attack vector in the system.
The simplest way, is encrypting the credentials in a file, and entering them manually on each operation.
Simple, a little bit more uncomfortable, since cretentials are no longer automated, but safer.
Encrypting a file
First, copy the necessary credentials to a file, e.g: credentials.txt
Create an encrypted credential file, user will be prompted to choose password:
gpg -c --cipher-algo AES256 credentials.txt
Physically remove the original unencrypted file
shred -u credentials.txt
Decrypting
gpg logs the passphrase for a few minutes by default.
The --no-symkey-cache flag is to not caching it at all.
Reading the file, user will be prompted to enter the chosen password:
gpg --no-symkey-cache -d credentials.txt.gpg
Clearing the GIT credentials
cd
git config --global --unset credential.helper
The output of this command must be empty
git config --show-origin --get-all credential.helper
And remove the unencrypted .git-credentials file
shred -u ~/.git-credentials
Bonus - Create alias to shortcut file
vim ~/.bash_aliases
alias creds="gpg --no-symkey-cache -d ~/path/to/credentials.txt.gpg"