1

Let’s say I created a deploy key with write permissions to repository A.

Let’s say repository A has a protected master branch that has " Require a pull request before merging " enabled and “Allow force pushes” and “Allow deletions” disabled for everyone including admins.

If a malicious attacker steals that deploy key, what damage can they do to the repository? Can they create a pull request? Can they merge that pull request?

Is my understanding correct that the only thing they can do is to create, modify, or delete unprotected branches in that repository? They can’t affect the protected branches in any way?

Improve this question
1

1 Answer 1

Reset to default
0

I asked this on the Github forum and received this answer:

Yes, I believe that is correct. They cannot execute GitHub related actions like creating/updating PRs/Issues or get access to your GitHub account in any way.

Keep in mind you can also create a deploy key that can just pull if you’re worried about changes being pushed.

Source: https://github.community/t/can-a-deploy-key-create-a-pull-request/245288

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .