Currently I have all my various keys in a config file which is version controlled on a PRIVATE repo. The code is on a trusted side (Github). Should I avoid version controlling this config file in git?
If not, then how would you share this file with the development team ?
Sharing a private key is always a bad practice... As an answer to your question there is nothing wrong with git as a key container, it is quite safe, even if safety depends on other elements, such as the security level of the git host. But you have no control on the key after another developer/user get it, so YES, as a good practice you should avoid this. Depending on your case maybe you can choose another solution, for example set up a one time password generator.
