In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer key and secret for each provider that we use.
The intention is to make it as simple as possible for a new developer to spin up a working development environment, and asking them to create a bunch of OAuth apps seemed undesirable.
For what it's worth, the details are as follows:
- assume local site development only (no remote data stores)
- providers include Twitter, GitHub, OpenStreetMaps, Bitbucket, Venmo, among others
- publicized secrets are only for testing apps