17

I've heard from several people that private repository servers like BitBucket are not really safe. I've heard rumours about code being stolen and used by people even out of private repositories.

Is it true? Is there any evidence, that cases like that could have happened?

Improve this question
2
  • instead of using a third party git repo, you could also host your own ... digitalocean.com/community/tutorials/… this will make it as secure as your SSH connection and the physical security of the server itself
    – CaffeineAddiction
    Commented Mar 7, 2017 at 18:37
  • 1
    Gitlab might be safer as it is open source with an active community.
    – Porcupine
    Commented Oct 24, 2018 at 9:26

2 Answers 2

Reset to default
39

A git repository is just files. So you're asking "Are private files safe?" To which the answer is "you're asking the wrong question".

A git repository is exactly as safe as the place that it storing it for you. No more, no less. If it's GitHub, then it's exactly as safe as GitHub is, And before you ask how safe GitHub is: nobody knows the answer but them.

Same story for BitBucket, Gitorius, Dropbox, Google Apps, Microsoft OneDrive and literally everywhere else you can store files (including your Git repo): Nobody can tell you how safe they are because nobody knows but the vendor. And the vendor always says they're safe.

If you're paranoid, keep your files on your own hard drive. In a mattress. Buried behind the shed.

Improve this answer
8
  • 6
    +1 though disagree about the "but them" part of "nobody knows the answer but them". They may think everything is safe, have sensible policies, information safeguards, and do their best to keep private data private. But they may use some piece of exploitable software in their stack or employ some unethical individual who exploits flaws in internal policies. Take for example, Edward Snowden leaking private information out of the NSA that he shouldn't have had permission to access. I imagine the NSA has stricter policies around private information than github.
    – dr jimbob
    Commented May 27, 2014 at 20:05
  • 8
    @drjimbob I would agree that technically nobody knows at all, but "they" have information that you don't have about their security, policies, motivations, etc., which puts them (and definitely not you) in the best position to make assessments. That's what I'm trying to say.
    – tylerl
    Commented May 27, 2014 at 20:17
  • One thing is what vendor says, and other - what vendor does. For example, the attachments to the issues are not safe at all: wishmesh.com/2017/03/…
    – Maris B.
    Commented Mar 7, 2017 at 13:55
  • @MarisB. It's difficult to do ACLs on a CDN, so obscure URLs are often used as a stand-in assuming the exposure risk is low. They intentionally made a security trade-off you don't like, but that doesn't mean it's broken. It just means that the issue tracker isn't designed to offer as strong protection as you want it to.
    – tylerl
    Commented Mar 7, 2017 at 16:53
  • 1
    Would creating an encrypted repo address any latent security issues?
    – Olumide
    Commented Mar 2, 2020 at 15:50
4

Technically, the vendors "Github, GitLab, Bitbucket etc." have access to all your source in "Your Repo" because it's "Their server" and "Their SaaS".

Their Server:

The vendor most likely has root access to their servers where your private or public repositories are stored in.

SaaS

It's the vendor's software that you subscribed for. They just have given it a different meaning. Assume your facebook account.

Improve this answer
2
  • 2
    What does your answer add to the already existing answer?
    – Kevin
    Commented May 11, 2019 at 10:57
  • 2
    It's a quick and more clear answer. You don't need to be technical either.
    – Sailab Rahi
    Commented Dec 29, 2019 at 22:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .