Questions tagged [git]

A popular distributed revision control system. Built for speed, data integrity and with support for distributed, non-linear workflows.

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

How to find a specific file's code in a website with a broken git commit? [migrated]

For a challenge I found that I was able to download files off of /.git/ After using the tools from GitTools I soon realised that my goal was to get to read config.inc.php file. But the problem is, I ...
0
votes
1answer
97 views

git reflog is showing plain text password used as a secret texts or files in Jenkins

We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
-2
votes
1answer
79 views

Source of RegEx examples of Secret Detection patterns in repositories?

Where can I find RegEx that can pattern match common secret strings? I have a product that scans repos and commits and in case a developer tries to commit a secret (i.e. passwords, keys). It scans for ...
0
votes
1answer
222 views

how to anonymously contribute to Github [closed]

I have noticed how important it has become to anonymously contribute to github. I have just created a new account with protonmail and removed my actual account from my Macbook. I still have the public ...
0
votes
1answer
43 views

Can we detect risk signals or potential vulnerabilities in git meta-data?

I'm wondering whether git commit metadata can shred light on potential risk signals or vulnerabilities. Henry Hinnefeld has investigated this, here but this seems to be a way of detecting ...
0
votes
1answer
76 views

What are the security risks if my server with github ssh access key is hacked?

I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS. If a hacker gains access to this AWS server, ...
0
votes
0answers
35 views

Does additional SSH access on top of HTTPS improve or harm the security of a self hosted Git server?

We have a self hosted git server in our company. It is reachable over the internet because our developers work together with external consultants, developers and other persons. Between the internet ...
6
votes
1answer
211 views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
0
votes
1answer
117 views

How to store encrypted notes in a public git repository?

I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server....
0
votes
1answer
101 views

Github private repo safe from scrapers?

I have a question about the security of private repo's on Github. Assume you use HTTPS authenticated against SAML SSO to fetch and push changes to remote. Could an outside adversary scrape the files ...
1
vote
0answers
46 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
2
votes
1answer
214 views

How secure is a git commit hash (sha1)?

Consider the following scenario: Someone, using a good version of git, issues a git clone followed by a git checkout of some commit hash (the 40 character hexadecimal). To clarify, assume Bob does ...
5
votes
1answer
207 views

What guarantees does GPG-signing a git commit provide?

It's pretty clear that GPG signing and GitHub ssh keys serve different purposes But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
2
votes
1answer
118 views

Do Git Commit signatures prevent repository modification?

Git commit signatures seems the signature signs the commit message, but I can't find much information on what the signatures actually solve, and don't understand the git architecture. If I have a ...
2
votes
0answers
96 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
1
vote
0answers
65 views

CVE vulnerable apps repository [closed]

According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists? Exploit-DB offers vulnerable apps, i.e. for: https://www.exploit-db.com/exploits/46962 it is ...
3
votes
1answer
654 views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
5
votes
1answer
218 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
3
votes
1answer
72 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
1
vote
2answers
153 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
1
vote
1answer
277 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
1
vote
0answers
54 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
1
vote
0answers
73 views

Secure scanning of git repositories

Is it possible to scan files on a 3rd party gitlab installation before they are downloaded ? In the scenario I'm thinking about colleagues are worried about the potential for malware to be attached ...
1
vote
1answer
94 views

How can I improve the security of my protected branches in GitHub/GitLab?

Many online Git hosting services (such as GitHub and GitLab) allow you to 'protect' certain branches so that only project administrators can modify them. The purpose of this is to allow non-admin ...
1
vote
2answers
84 views

Automatic push on commit (on bitbucket repository)

I have a website which commits to a git local repository all the changes done. I need to automatically push them directly from the web server to a remote Bitbucket repository. The authentication ...
2
votes
0answers
164 views

PCI Compliance and Git

We are currently moving to get a ci\cd pipeline running on Gitlab. Our current set up is we have a non-production and a production environment on separate networks. This reduces the PCI scope to just ...
1
vote
2answers
190 views

Does git use the ssh user keys or the repository's deploy keys for encryption?

In this question I asked, why the SSH-Host key shown when connecting to a gitlab repository does not match the one shown on the instance configuration page. Nevertheless, the accepted answer says that ...
7
votes
2answers
2k views

Is it safe to store APK signing passwords in private git repository?

I develop android game using cocos2d-x. For android release, it contain this fields in proj.android/gradle.properties: # uncomment it and fill in sign information for release mode #RELEASE_STORE_FILE=...
0
votes
3answers
268 views

Does Git usage raise a valid security concern? If so, how? [closed]

This is about pure-and-simple Git; NOT the security concerns of using third party services like Github or Gitlab. While working on a closed source security project, during a meeting, one of the ...
6
votes
3answers
768 views

Safe to commit OpenVPN client config to Git?

I'd like to commit my OpenVPN client config to version control, in a repo that's remotely hosted and publicly accessible. This would reveal the server's hostname and port, as well as the filepaths to ...
2
votes
0answers
65 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
0
votes
3answers
865 views

Why does Github need to offer a GPG signature feature?

Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
3
votes
1answer
111 views

What information in sent in the clear when git redirects from HTTP to HTTPS?

If a user tries git commands pointed at an http://gitlab.example.com address (and they have not connected to this domain before), the gitlab.example.com server redirects (or rewrites) to https://...
1
vote
1answer
103 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
4
votes
1answer
76 views

Restrict compilation to certain machines

I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images. So technically this ...
3
votes
2answers
2k views

Deleted commit still visible from GitLab web interface, exposing sensitive data [closed]

Some weeks ago I accidentally committed a configuration file containing some passwords and I pushed it on a GitLab remote managed by my company. After that I used BFG Repo-Cleaner to remove the ...
2
votes
0answers
210 views

Is standalone git susceptible to MITM?

Is standalone Git protocol susceptible to MITM where an attacker impersonates the server? According to https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols There are 3 main protocols to ...
0
votes
2answers
552 views

Blindly downloading a git repo: specifically, generating .pack files

I'm pen-testing an application with a bug bounty program. I've found a .git folder which just gives a 403 forbidden error. However, when browsing to directories such as dodgy.com/.git/config, the ...
2
votes
1answer
657 views

Is it acceptable to share private SSH keys across servers for read-only access to a Git repository?

I'm working on a project currently stored in a private Git repository on Bitbucket, that will be deployed to multiple external servers. Because the repo is private, I need these servers to be able to ...
5
votes
3answers
266 views

In what ways is Git a security measure?

When the boss asks why Git is good, can I justify using security as one of the reasons? Under Git, it's easy to track changes. Maliciously altered files can be revealed with a simple 'git diff' on ...
2
votes
1answer
234 views

Reporting leaked passwords in github repository

I have just found a handful of repositories on github that contain database passwords. I want to let the concerned parties know about this so that they can change their passwords and remove the ...
9
votes
1answer
736 views

Is it safe to share your `gitconfig`'s `user.signingkey` value with the world?

I'd like to publish my .gitconfig file on GitHub, which includes a signing key. As far as I understand, since this is related to code signing, the key referenced there is the ID of my private GPG key....
5
votes
0answers
130 views

How could Git be exploited using an SHA-1 collision? [duplicate]

Now that Google has created an SHA-1 collision, I've been wondering how this affects Git, which is still using SHA-1 for some reason. What would happen if there were two objects with the same hash, ...
1
vote
1answer
472 views

Is making e-mail addresses visible and impersonation possible by GitHub an acceptable practice? [closed]

I am under impression that protecting privacy of user is a "big deal" - even if only declaratively. Example: discussion on meta about e-mail addresses on SO. Whilst I do expect that sooner or later ...
1
vote
1answer
2k views

How Secure is my Heroku Source Code?

I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances. First off, I am aware that I am handing ...
3
votes
0answers
650 views

Why does Linux Torvalds not sign his Git commits? [closed]

Why does Linux Torvalds not sign his Git commits (with GPG)? Recent example: https://github.com/torvalds/linux/commit/566cf877a1fcb6d6dc0126b076aad062054c2637 Pretty scary. How can I be sure that he ...
1
vote
1answer
135 views

Store github credentials

I am new to the security section. I want to write a cross-platform Java Desktop application which ask a user for their credentials and connects to their github account.What I want to do is If the ...
0
votes
2answers
1k views

Should I host portfolio website in public GitHub repository? [closed]

I have a small portfolio site that I work on in my spare time as a way of demonstrating and applying what I have learned from school/work. Part of this demonstration involves me currently listing the ...
3
votes
2answers
788 views

Can a ransomware “destroy” git remote repositories?

Instead of a backup, i store my important documents (my resumee, certificates and such) in a git repository - which is then pushed to sth like github. My reasons for using git instead of an backup ...
0
votes
2answers
110 views

Publishing proxy server IP address on github

Is it safe to store proxy IP address and port in a shell config file on github? I see some people doing that and don't worry about it.