Questions tagged [git]

A popular distributed revision control system. Built for speed, data integrity and with support for distributed, non-linear workflows.

Filter by
Sorted by
Tagged with
1
vote
1answer
45 views

Do Git Commit signatures prevent repository modification?

Git commit signatures seems the signature signs the commit message, but I can't find much information on what the signatures actually solve, and don't understand the git architecture. If I have a ...
2
votes
0answers
74 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
1
vote
0answers
50 views

CVE vulnerable apps repository [closed]

According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists? Exploit-DB offers vulnerable apps, i.e. for: https://www.exploit-db.com/exploits/46962 it is ...
0
votes
0answers
40 views

Handle secret/private credentials when using Git?

When using Git and 3rd party vendors for repositories (such a GitHub, GitLab or Bitbucket), is there any way to handle the system's private API tokens or the database setup configuration? More than ...
0
votes
0answers
34 views

Store secret for HS256 (JWT) in repository?

For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no. So how can I store the secret in ...
3
votes
1answer
308 views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
5
votes
1answer
93 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
3
votes
1answer
57 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
1
vote
2answers
71 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
1
vote
1answer
121 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
1
vote
0answers
34 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
1
vote
0answers
61 views

Secure scanning of git repositories

Is it possible to scan files on a 3rd party gitlab installation before they are downloaded ? In the scenario I'm thinking about colleagues are worried about the potential for malware to be attached ...
1
vote
1answer
82 views

How can I improve the security of my protected branches in GitHub/GitLab?

Many online Git hosting services (such as GitHub and GitLab) allow you to 'protect' certain branches so that only project administrators can modify them. The purpose of this is to allow non-admin ...
1
vote
2answers
64 views

Automatic push on commit (on bitbucket repository)

I have a website which commits to a git local repository all the changes done. I need to automatically push them directly from the web server to a remote Bitbucket repository. The authentication ...
2
votes
0answers
133 views

PCI Compliance and Git

We are currently moving to get a ci\cd pipeline running on Gitlab. Our current set up is we have a non-production and a production environment on separate networks. This reduces the PCI scope to just ...
1
vote
2answers
163 views

Does git use the ssh user keys or the repository's deploy keys for encryption?

In this question I asked, why the SSH-Host key shown when connecting to a gitlab repository does not match the one shown on the instance configuration page. Nevertheless, the accepted answer says that ...
7
votes
2answers
2k views

Is it safe to store APK signing passwords in private git repository?

I develop android game using cocos2d-x. For android release, it contain this fields in proj.android/gradle.properties: # uncomment it and fill in sign information for release mode #RELEASE_STORE_FILE=...
0
votes
3answers
228 views

Does Git usage raise a valid security concern? If so, how? [closed]

This is about pure-and-simple Git; NOT the security concerns of using third party services like Github or Gitlab. While working on a closed source security project, during a meeting, one of the ...
6
votes
3answers
723 views

Safe to commit OpenVPN client config to Git?

I'd like to commit my OpenVPN client config to version control, in a repo that's remotely hosted and publicly accessible. This would reveal the server's hostname and port, as well as the filepaths to ...
2
votes
0answers
64 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
0
votes
3answers
460 views

Why does Github need to offer a GPG signature feature?

Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
3
votes
1answer
111 views

What information in sent in the clear when git redirects from HTTP to HTTPS?

If a user tries git commands pointed at an http://gitlab.example.com address (and they have not connected to this domain before), the gitlab.example.com server redirects (or rewrites) to https://...
1
vote
1answer
102 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
4
votes
1answer
75 views

Restrict compilation to certain machines

I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images. So technically this ...
1
vote
2answers
1k views

Deleted commit still visible from GitLab web interface, exposing sensitive data [closed]

Some weeks ago I accidentally committed a configuration file containing some passwords and I pushed it on a GitLab remote managed by my company. After that I used BFG Repo-Cleaner to remove the ...
1
vote
0answers
187 views

Is standalone git susceptible to MITM?

Is standalone Git protocol susceptible to MITM where an attacker impersonates the server? According to https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols There are 3 main protocols to ...
0
votes
2answers
434 views

Blindly downloading a git repo: specifically, generating .pack files

I'm pen-testing an application with a bug bounty program. I've found a .git folder which just gives a 403 forbidden error. However, when browsing to directories such as dodgy.com/.git/config, the ...
2
votes
1answer
518 views

Is it acceptable to share private SSH keys across servers for read-only access to a Git repository?

I'm working on a project currently stored in a private Git repository on Bitbucket, that will be deployed to multiple external servers. Because the repo is private, I need these servers to be able to ...
5
votes
3answers
239 views

In what ways is Git a security measure?

When the boss asks why Git is good, can I justify using security as one of the reasons? Under Git, it's easy to track changes. Maliciously altered files can be revealed with a simple 'git diff' on ...
2
votes
1answer
212 views

Reporting leaked passwords in github repository

I have just found a handful of repositories on github that contain database passwords. I want to let the concerned parties know about this so that they can change their passwords and remove the ...
8
votes
1answer
563 views

Is it safe to share your `gitconfig`'s `user.signingkey` value with the world?

I'd like to publish my .gitconfig file on GitHub, which includes a signing key. As far as I understand, since this is related to code signing, the key referenced there is the ID of my private GPG key....
5
votes
0answers
126 views

How could Git be exploited using an SHA-1 collision? [duplicate]

Now that Google has created an SHA-1 collision, I've been wondering how this affects Git, which is still using SHA-1 for some reason. What would happen if there were two objects with the same hash, ...
1
vote
1answer
248 views

Is making e-mail addresses visible and impersonation possible by GitHub an acceptable practice? [closed]

I am under impression that protecting privacy of user is a "big deal" - even if only declaratively. Example: discussion on meta about e-mail addresses on SO. Whilst I do expect that sooner or later ...
1
vote
1answer
1k views

How Secure is my Heroku Source Code?

I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances. First off, I am aware that I am handing ...
3
votes
0answers
561 views

Why does Linux Torvalds not sign his Git commits? [closed]

Why does Linux Torvalds not sign his Git commits (with GPG)? Recent example: https://github.com/torvalds/linux/commit/566cf877a1fcb6d6dc0126b076aad062054c2637 Pretty scary. How can I be sure that he ...
1
vote
1answer
122 views

Store github credentials

I am new to the security section. I want to write a cross-platform Java Desktop application which ask a user for their credentials and connects to their github account.What I want to do is If the ...
0
votes
2answers
837 views

Should I host portfolio website in public GitHub repository? [closed]

I have a small portfolio site that I work on in my spare time as a way of demonstrating and applying what I have learned from school/work. Part of this demonstration involves me currently listing the ...
2
votes
2answers
717 views

Can a ransomware “destroy” git remote repositories?

Instead of a backup, i store my important documents (my resumee, certificates and such) in a git repository - which is then pushed to sth like github. My reasons for using git instead of an backup ...
0
votes
2answers
95 views

Publishing proxy server IP address on github

Is it safe to store proxy IP address and port in a shell config file on github? I see some people doing that and don't worry about it.
1
vote
0answers
34 views

Would it be possible to construct a generic security advisory mechanism for git repositories?

It seems to have become easier, and thus more common for software to be deployed by simply checking it out of a git repository, rather than going via release versions. This makes it difficult to know ...
4
votes
1answer
5k views

Read all git cached password

in a 10+ people team we access the same ubuntu VM and we 'su' to the same user. On that user we make use of git-credential-cache feature to not type our personal password again and again. As all ...
13
votes
1answer
3k views

Can I use GitHub and be PCI DSS compliant?

Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?
2
votes
2answers
56 views

Is secure to enable tools like git on shared server?

I want to know if there is a real security reason to not enable tools like git, WP-CLI or npm. I want to run a server (Centos/CPanel), but I want to be sure that enabling them would not be a risk. ...
3
votes
1answer
301 views

What personally identifying data does does command line Git send?

What identifying data (such as hostname) does command line Git send when: cloning commiting/pushing I expect git config data (specified email and full name) to be sent when commiting/pushing. Does ...
1
vote
0answers
637 views

Storing password or access token in standalone Java app

I have a simple Java app that use Eclipse JGit to pull remote repositories into the app to analyze and provide the user with code metric details on their projects. This app is supposed to be able to ...
2
votes
0answers
182 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
2
votes
1answer
289 views

Why should I sign git commits/tags? Should I sign both commits and tags?

Easy question, but no one has asked it here as far as I see: Why should I sign git commits? To give some more things to answer there is also this question: Why should I sign git tags (releases)? And ...
1
vote
1answer
949 views

What's wrong with RSA host key mismatch when using git?

I was pushing codes to github from a repo via a proxy (socks5) proxychains git push -uv origin master Warning: the RSA host key for 'github.com' differs from the key for the IP address '224.0.0.1' ...
4
votes
3answers
219 views

What can be done to secure passwords that might be stored in plain text or hashed inside a git repository?

I've heard a lot lately about coders being really bad at security. For one they store passwords and sensitive information inside Git repos which are often not secured well enough. Someone then comes ...
11
votes
1answer
775 views

Should I recreate Git tags after revoking a signing key?

Let's say my signing key has been compromised and I have to revoke it. What happens to the changesets and tags already signed? Should I rewrite them with the new signing key?