title: How do you avoid storing passwords in version control?
body: <p>What strategy do you use to avoid storing passwords in version control?</p>
  
  <p>Currently, I have development/test/production passwords saved in three different files and the appropriate file gets used during deployment. All this is committed to version control, but I'm not too happy with that since not all developers need to know those passwords (especially outsourced ones, which have access only while their projects last, which could be only a month).</p>
  
  <p>Storing passwords in database is not a great option:</p>
  
  <ul>
  <li>I need most of the data during the initialization of Spring context (Java app), and I don't want to build scaffolding for connecting to a single database, and afterwards connecting to the rest of databases and initializing the rest of application</li>
  <li>some of the passwords are only deployment-related; password to access different servers, keystores, etc.; those are the things application can't load after it starts, since it doesn't load it at all</li>
  </ul>
  
  <p>I'm thinking about moving deployment configuration from developer machine to dedicated computer which checks out code from version control and runs build/deployment script, but I'm not really sure what would be the best way to do it.</p>
  
  <p>I also need to say that I don't want ultimate security: I just want to avoid having passwords on every developer's disk and making it too easy.</p>
  
  <p>So I'm asking for your experiences/best practices. How do you do it?</p>