4

I've heard from several people that private repository servers like BitBucket are not really safe. I've heard rumours about code being stolen and used by people even out of private repositories.

Is it true? Is there any evidence, that cases like that could have happened?

  • instead of using a third party git repo, you could also host your own ... digitalocean.com/community/tutorials/… this will make it as secure as your SSH connection and the physical security of the server itself – CaffeineAddiction Mar 7 '17 at 18:37
  • Gitlab might be safer as it is open source with an active community. – Nikhil Oct 24 '18 at 9:26
19

A git repository is just files. So you're asking "Are private files safe?" To which the answer is "you're asking the wrong question".

A git repository is exactly as safe as the place that it storing it for you. No more, no less. If it's GitHub, then it's exactly as safe as GitHub is, And before you ask how safe GitHub is: nobody knows the answer but them.

Same story for BitBucket, Gitorius, Dropbox, Google Apps, Microsoft OneDrive and literally everywhere else you can store files (including your Git repo): Nobody can tell you how safe they are because nobody knows but the vendor. And the vendor always says they're safe.

If you're paranoid, keep your files on your own hard drive. In a mattress. Buried behind the shed.

  • 3
    +1 though disagree about the "but them" part of "nobody knows the answer but them". They may think everything is safe, have sensible policies, information safeguards, and do their best to keep private data private. But they may use some piece of exploitable software in their stack or employ some unethical individual who exploits flaws in internal policies. Take for example, Edward Snowden leaking private information out of the NSA that he shouldn't have had permission to access. I imagine the NSA has stricter policies around private information than github. – dr jimbob May 27 '14 at 20:05
  • 7
    @drjimbob I would agree that technically nobody knows at all, but "they" have information that you don't have about their security, policies, motivations, etc., which puts them (and definitely not you) in the best position to make assessments. That's what I'm trying to say. – tylerl May 27 '14 at 20:17
  • One thing is what vendor says, and other - what vendor does. For example, the attachments to the issues are not safe at all: wishmesh.com/2017/03/… – Maris B. Mar 7 '17 at 13:55
  • @MarisB. It's difficult to do ACLs on a CDN, so obscure URLs are often used as a stand-in assuming the exposure risk is low. They intentionally made a security trade-off you don't like, but that doesn't mean it's broken. It just means that the issue tracker isn't designed to offer as strong protection as you want it to. – tylerl Mar 7 '17 at 16:53
  • @tylerl. If they document this (lack of ACLs) in the documentation / help pages, then I don't see the problem. Users should know, how secure private repositories are. – Maris B. Mar 8 '17 at 14:01
-1

Technically, the vendors "Github, GitLab, Bitbucket etc." have access to all your source in "Your Repo" because it's "Their server" and "Their SaaS".

Their Server:

The vendor most likely has root access to their servers where your private or public repositories are stored in.

SaaS

It's the vendor's software that you subscribed for. They just have given it a different meaning. Assume your facebook account.

  • 1
    What does your answer add to the already existing answer? – Kevin Voorn May 11 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.