Stupid question: is there a secure way to specify `clientSecret`?

To make gitalk work, we’re supposed to specify some information from oauth as follows:

const gitalk = new Gitalk({
  clientID: 'GitHub Application Client ID',
  clientSecret: 'GitHub Application Client Secret',
  repo: 'GitHub repo',
  owner: 'GitHub repo owner',
  admin: ['GitHub repo owner and collaborators, only these guys can initialize github issues'],
  id: location.pathname,      // Ensure uniqueness and length less than 50
  distractionFreeMode: false  // Facebook-like distraction free mode
})

gitalk.render('gitalk-container')

My question is whether it’s a security hazard to have the clientID and clientSecret pasted in that location, and of not whether there’s a better, more secure way to store it. (I tend to use jekyll and GitHub pages…)

Thanks for any guidance; I’m aware that this is something of a stupid question

[krasimir]

Probably I’m missing something but … isn’t it Gitalk a client-side plugin/library. As such we have to initialize the gitalk instance on the page. So, even if I put my secret in a env variable at the end will be dumped into the html that the browser loads so it is publicly available. Am I missing something here?

[TheFirstMe]

@jdossgollin Putting in secret keys directly is definitely a bad idea.