An SSH private key can authenticate access without typing the account password, so it must be protected like a password.
- Keep the private key only on trusted devices.
- Use a passphrase when practical.
- Do not commit private keys to Git repositories.
- Do not upload them into publicly served website directories.
- Deauthorize or replace a key if its private half may have been exposed.
Public SSH keys are designed to be shared with the server; private keys are not.
