Delete Capfile & deploy.rb after deployment about capistrano HOT 1 CLOSED

The deploy.rb and Capfile are part of your source repository, deleting them from the server leaves your <scm> status unclean.

The thin veil of security as an excuse for deleting them doesn't actually solve any security issues (if someone is reading code on your app server, they're already too far penetrated into your codebase. If you're speaking about security within your own team, it's not an open source Gem's responsibility to facilitate that.

I recommend not putting any passwords into the Capfile, if you're using Subversion, I know that can be tricky; but using a decent, modern SCM which has SSH as a transport, you can use SSH (with agent forwarding, or deploy keys) to make sure you don't need any deploy-time passwords to get at the code.

And regarding database passwords, or otherwise which can be in those files, they should be deployed to the server by a trusted member of staff, and symlinked from the deployment each time through.

Thanks for opening the issue, but it's not really a security improvement.

from capistrano.