Questions tagged [git]

A popular distributed revision control system. Built for speed, data integrity and with support for distributed, non-linear workflows.

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Is the End-To-End Encryption (E2EE) of Joplin (notes app) secure enough for public Git repo?

Because privacytools.io recommends Joplin I am switching my notes to it. I add the text files to Git, and wonder if I can also use a public Repo and/or a cloud hosted Git server? I will paste ...
0
votes
1answer
48 views

Github private repo safe from scrapers?

I have a question about the security of private repo's on Github. Assume you use HTTPS authenticated against SAML SSO to fetch and push changes to remote. Could an outside adversary scrape the files ...
1
vote
0answers
46 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
1
vote
0answers
117 views

How secure is a git commit hash (sha1)?

Consider the following scenario: Someone, using a good version of git, issues a git clone followed by a git checkout of some commit hash (the 40 character hexadecimal). To clarify, assume Bob does ...
4
votes
1answer
138 views

What guarantees does GPG-signing a git commit provide?

It's pretty clear that GPG signing and GitHub ssh keys serve different purposes But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
2
votes
1answer
87 views

Do Git Commit signatures prevent repository modification?

Git commit signatures seems the signature signs the commit message, but I can't find much information on what the signatures actually solve, and don't understand the git architecture. If I have a ...
2
votes
0answers
83 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
1
vote
0answers
58 views

CVE vulnerable apps repository [closed]

According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists? Exploit-DB offers vulnerable apps, i.e. for: https://www.exploit-db.com/exploits/46962 it is ...
0
votes
0answers
41 views

Handle secret/private credentials when using Git?

When using Git and 3rd party vendors for repositories (such a GitHub, GitLab or Bitbucket), is there any way to handle the system's private API tokens or the database setup configuration? More than ...
0
votes
0answers
44 views

Store secret for HS256 (JWT) in repository?

For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no. So how can I store the secret in ...
3
votes
1answer
514 views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
5
votes
1answer
134 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
3
votes
1answer
65 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
1
vote
2answers
138 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
1
vote
1answer
203 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
1
vote
0answers
52 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
1
vote
0answers
68 views

Secure scanning of git repositories

Is it possible to scan files on a 3rd party gitlab installation before they are downloaded ? In the scenario I'm thinking about colleagues are worried about the potential for malware to be attached ...
1
vote
1answer
90 views

How can I improve the security of my protected branches in GitHub/GitLab?

Many online Git hosting services (such as GitHub and GitLab) allow you to 'protect' certain branches so that only project administrators can modify them. The purpose of this is to allow non-admin ...
1
vote
2answers
70 views

Automatic push on commit (on bitbucket repository)

I have a website which commits to a git local repository all the changes done. I need to automatically push them directly from the web server to a remote Bitbucket repository. The authentication ...
2
votes
0answers
148 views

PCI Compliance and Git

We are currently moving to get a ci\cd pipeline running on Gitlab. Our current set up is we have a non-production and a production environment on separate networks. This reduces the PCI scope to just ...
1
vote
2answers
177 views

Does git use the ssh user keys or the repository's deploy keys for encryption?

In this question I asked, why the SSH-Host key shown when connecting to a gitlab repository does not match the one shown on the instance configuration page. Nevertheless, the accepted answer says that ...
7
votes
2answers
2k views

Is it safe to store APK signing passwords in private git repository?

I develop android game using cocos2d-x. For android release, it contain this fields in proj.android/gradle.properties: # uncomment it and fill in sign information for release mode #RELEASE_STORE_FILE=...
0
votes
3answers
245 views

Does Git usage raise a valid security concern? If so, how? [closed]

This is about pure-and-simple Git; NOT the security concerns of using third party services like Github or Gitlab. While working on a closed source security project, during a meeting, one of the ...
6
votes
3answers
748 views

Safe to commit OpenVPN client config to Git?

I'd like to commit my OpenVPN client config to version control, in a repo that's remotely hosted and publicly accessible. This would reveal the server's hostname and port, as well as the filepaths to ...
2
votes
0answers
64 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
0
votes
3answers
667 views

Why does Github need to offer a GPG signature feature?

Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
3
votes
1answer
111 views

What information in sent in the clear when git redirects from HTTP to HTTPS?

If a user tries git commands pointed at an http://gitlab.example.com address (and they have not connected to this domain before), the gitlab.example.com server redirects (or rewrites) to https://...
1
vote
1answer
103 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
4
votes
1answer
75 views

Restrict compilation to certain machines

I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images. So technically this ...
2
votes
2answers
2k views

Deleted commit still visible from GitLab web interface, exposing sensitive data [closed]

Some weeks ago I accidentally committed a configuration file containing some passwords and I pushed it on a GitLab remote managed by my company. After that I used BFG Repo-Cleaner to remove the ...
2
votes
0answers
201 views

Is standalone git susceptible to MITM?

Is standalone Git protocol susceptible to MITM where an attacker impersonates the server? According to https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols There are 3 main protocols to ...
0
votes
2answers
505 views

Blindly downloading a git repo: specifically, generating .pack files

I'm pen-testing an application with a bug bounty program. I've found a .git folder which just gives a 403 forbidden error. However, when browsing to directories such as dodgy.com/.git/config, the ...
2
votes
1answer
589 views

Is it acceptable to share private SSH keys across servers for read-only access to a Git repository?

I'm working on a project currently stored in a private Git repository on Bitbucket, that will be deployed to multiple external servers. Because the repo is private, I need these servers to be able to ...
5
votes
3answers
254 views

In what ways is Git a security measure?

When the boss asks why Git is good, can I justify using security as one of the reasons? Under Git, it's easy to track changes. Maliciously altered files can be revealed with a simple 'git diff' on ...
2
votes
1answer
224 views

Reporting leaked passwords in github repository

I have just found a handful of repositories on github that contain database passwords. I want to let the concerned parties know about this so that they can change their passwords and remove the ...
8
votes
1answer
651 views

Is it safe to share your `gitconfig`'s `user.signingkey` value with the world?

I'd like to publish my .gitconfig file on GitHub, which includes a signing key. As far as I understand, since this is related to code signing, the key referenced there is the ID of my private GPG key....
5
votes
0answers
129 views

How could Git be exploited using an SHA-1 collision? [duplicate]

Now that Google has created an SHA-1 collision, I've been wondering how this affects Git, which is still using SHA-1 for some reason. What would happen if there were two objects with the same hash, ...
1
vote
1answer
340 views

Is making e-mail addresses visible and impersonation possible by GitHub an acceptable practice? [closed]

I am under impression that protecting privacy of user is a "big deal" - even if only declaratively. Example: discussion on meta about e-mail addresses on SO. Whilst I do expect that sooner or later ...
1
vote
1answer
2k views

How Secure is my Heroku Source Code?

I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances. First off, I am aware that I am handing ...
3
votes
0answers
607 views

Why does Linux Torvalds not sign his Git commits? [closed]

Why does Linux Torvalds not sign his Git commits (with GPG)? Recent example: https://github.com/torvalds/linux/commit/566cf877a1fcb6d6dc0126b076aad062054c2637 Pretty scary. How can I be sure that he ...
1
vote
1answer
129 views

Store github credentials

I am new to the security section. I want to write a cross-platform Java Desktop application which ask a user for their credentials and connects to their github account.What I want to do is If the ...
0
votes
2answers
984 views

Should I host portfolio website in public GitHub repository? [closed]

I have a small portfolio site that I work on in my spare time as a way of demonstrating and applying what I have learned from school/work. Part of this demonstration involves me currently listing the ...
2
votes
2answers
755 views

Can a ransomware “destroy” git remote repositories?

Instead of a backup, i store my important documents (my resumee, certificates and such) in a git repository - which is then pushed to sth like github. My reasons for using git instead of an backup ...
0
votes
2answers
102 views

Publishing proxy server IP address on github

Is it safe to store proxy IP address and port in a shell config file on github? I see some people doing that and don't worry about it.
1
vote
0answers
34 views

Would it be possible to construct a generic security advisory mechanism for git repositories?

It seems to have become easier, and thus more common for software to be deployed by simply checking it out of a git repository, rather than going via release versions. This makes it difficult to know ...
4
votes
1answer
6k views

Read all git cached password

in a 10+ people team we access the same ubuntu VM and we 'su' to the same user. On that user we make use of git-credential-cache feature to not type our personal password again and again. As all ...
14
votes
1answer
3k views

Can I use GitHub and be PCI DSS compliant?

Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?
2
votes
2answers
56 views

Is secure to enable tools like git on shared server?

I want to know if there is a real security reason to not enable tools like git, WP-CLI or npm. I want to run a server (Centos/CPanel), but I want to be sure that enabling them would not be a risk. ...
4
votes
1answer
326 views

What personally identifying data does does command line Git send?

What identifying data (such as hostname) does command line Git send when: cloning commiting/pushing I expect git config data (specified email and full name) to be sent when commiting/pushing. Does ...
1
vote
0answers
688 views

Storing password or access token in standalone Java app

I have a simple Java app that use Eclipse JGit to pull remote repositories into the app to analyze and provide the user with code metric details on their projects. This app is supposed to be able to ...