2022 Developer Survey is open! Take survey.

Questions tagged [github]

github.com is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]

Filter by
Sorted by
Tagged with
0 votes
3 answers
150 views

Employee uploaded proprietary private repository on his github public account

A newly joined software engineer in our organization uploaded one of company's proprietary git repository on his personal Github public account, likely without nefarious intent. How do I ensure this ...
user avatar
  • 149
1 vote
1 answer
48 views

What can an attacker do with a stolen GitHub deploy key?

Let’s say I created a deploy key with write permissions to repository A. Let’s say repository A has a protected master branch that has " Require a pull request before merging " enabled and “...
user avatar
  • 11
0 votes
0 answers
23 views

Is it possible to configure Github to allow writes to a particular repo/organisation, only from a particular SSH key?

It's not uncommon for an organization to allow developers to use their personal Github to do their work. A potential problem I see with this, is that the organization doesn't have control over that ...
user avatar
0 votes
0 answers
34 views

What is GitHub authentication SDT ? And why is it sending OTP from a residential number? [duplicate]

I had enabled 2FA for GitHub using a mobile number. Today when I tried to log in from a different device, during the 2FA verification time, I received the code from a consumer phone number [ +91 ...
user avatar
-2 votes
1 answer
175 views

Infecting files on GitHub

Suppose one uploads (carelessly or purposefully) a file with a malicious payload to their Github account (some pdf document, picture, etc.). Could this payload somehow be executed on the Github ...
user avatar
1 vote
1 answer
77 views

SSH to github.com only adds RSA keys - excludes ed25519 host keys

I am doing some tests around ssh. From what I have seen a server usually has multiple host keys. When a client tries to connect, it tries to negotiate which key types to use DSA, RSA, ECDSA, etc. But ...
user avatar
0 votes
0 answers
15 views

Publish public GPG key on GitHub [duplicate]

Is it safe to publish your public GPG keys on GitHub? And link to them in the signature of the e-mails you send, together with the fingerprint after the link?
user avatar
-2 votes
2 answers
118 views

I accidentally clicked on ransomware link. Antivirus cleaned the files successfully

I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...
user avatar
0 votes
2 answers
153 views

Secure way to set up GitHub repository in shared remote machine

I have access to a shared remote machine to execute code and store data, accessible through SSH from my local machine, but I do not have root privileges there. The remote is shared among many users. I ...
user avatar
0 votes
1 answer
813 views

Using Github's Public IP Address as Remote URL

My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github. Some IT departments have github blocked on ...
user avatar
0 votes
1 answer
199 views

Is it possible to find the owner of a GitHub Pages site that is connected to a custom domain?

I am curious whether someone could find out if a site hosted on GitHub Pages could be traced back to the user that published it. This is of course, assuming that: the GitHub repository containing the ...
user avatar
0 votes
1 answer
118 views

Github.com token authorisation since 13th August, impractical?

Gihub removed password authentication: remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information. fatal: unable to access 'https://...
user avatar
1 vote
0 answers
150 views

What are the best practices pertaining to signing your git commits on GitHub?

On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits. However, in the scenario that the private key is exposed, the only option GitHub offers is ...
user avatar
  • 115
106 votes
4 answers
15k views

Suspicious GitHub fork

Update (April 15): The forked repo and the user do not exist any more. Yesterday, one of my GitHub projects was forked and there is a suspicious commit on the fork of the repo. As you can see from the ...
user avatar
  • 883
2 votes
0 answers
95 views

Are there any risks associated with publishing AWS VPC ids, Subnet ids?

I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public. I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
user avatar
  • 121
4 votes
0 answers
1k views

Is github1s.com safe ? How does it work? [closed]

My colleagues started using https://github1s.com to browse our company's code on Github. It pops a "visual studio" window for the code. Looks great and useful. But... I don't know much about ...
user avatar
  • 141
2 votes
2 answers
242 views

How is a DNS wildcard a security issue for GitHub Pages?

GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so: GitHub must be set up to recognize that an ...
user avatar
  • 8,923
1 vote
1 answer
122 views

How does one tighten up their git repo security for Powershell?

Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after ...
user avatar
  • 1,237
1 vote
2 answers
389 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
user avatar
2 votes
1 answer
1k views

Fingerprints of a RSA keys - GitHub not matching?

I am wondering how those RSA fingerprints work. I have a GitHub account and created an RSA key pair to set up an ssh connection. Then followed the instruction... First time I connect to my GitHub it ...
user avatar
0 votes
1 answer
113 views

How to store Personal Access Token securely on shared machine

We have a shared machine in the office, used for demo'ing our product. I want to be able to fetch the latest code from Github. We have 2FA enabled, so I can't use my login password for https ...
user avatar
  • 173
0 votes
2 answers
185 views

Solutions for backing-up my codebase

I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
user avatar
1 vote
1 answer
340 views

What are the security risks if my server with github ssh access key is hacked?

I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS. If a hacker gains access to this AWS server, ...
user avatar
  • 211
6 votes
1 answer
2k views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
user avatar
  • 163
0 votes
1 answer
360 views

Github private repo safe from scrapers?

I have a question about the security of private repo's on Github. Assume you use HTTPS authenticated against SAML SSO to fetch and push changes to remote. Could an outside adversary scrape the files ...
user avatar
0 votes
0 answers
263 views

Packaging Python code for github: should I obfuscate author email address from the `setup.py`?

The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
user avatar
5 votes
1 answer
701 views

Risks of allowing employees using personal GitHub accounts for work

Proprietary software developed by a (smallish) company is stored in the company's GitHub private repository. For work, software engineers are requested to create company-specific GitHub account bound ...
user avatar
3 votes
1 answer
329 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
user avatar
  • 133
1 vote
0 answers
165 views

Recruiter pretends to have found my e-mail address through GitHub account. How to check if this is true? [closed]

A recruiter directly e-mailed me about a job offer and pretended to have found the e-mail address via my GitHub account. Normally I receive e-mails via LinkedIn and almost never directly, as I try my ...
user avatar
  • 2,173
2 votes
0 answers
294 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
user avatar
  • 458
2 votes
1 answer
142 views

Webhook Security

I'm following this guide on: How to set up CI/CD Pipeline for a node.js app with Jenkins I've installed Jenkins on a VPS and I can access the Web UI over an SSH Tunnel. Then I saw this: http://...
user avatar
2 votes
1 answer
239 views

Suspicious GitHub mirror site (https://hzb.world/)

Through some odd Google rabbit hole, I ended up at what appeared to be the GitHub website. I reflexively tried logging in to view my repositories. Upon attempting to log in, it said my browser did ...
user avatar
1 vote
0 answers
123 views

How to verify a binary correctly even if my github account is hacked by someone

I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases To allow users to verify it, I saved sha256sum and signature(.asc). However I have a concern that if ...
user avatar
  • 185
1 vote
1 answer
297 views

Is it safe to use Giphy API keys in public Github repo?

I am making a game of which one of the hidden features is displaying a GIF from Giphy at a fixed command. For this, I am using Giphy API, hosting the game as a website on Github Pages with a public ...
user avatar
  • 115
1 vote
2 answers
1k views

Should I delete lost GPG key from GitHub?

I've been using GPG key for a while to sign commits on GitHub. However, I recently lost it by accident when moving data around. It haven't leaked anywhere and signed commits can be trusted, I just don'...
user avatar
4 votes
1 answer
1k views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
user avatar
172 votes
4 answers
43k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
user avatar
  • 1,103
19 votes
1 answer
5k views

Github account hacked and repo wiped - Github Response

One of my repo's was wiped today and just a message left in its place with a bitcoin ransom. I've no idea how they accessed my account, can't really see anything on github security page. The domain of ...
user avatar
  • 191
21 votes
3 answers
8k views

Can I rely on these GitHub repository files?

I recently found the GitHub repository https://github.com/userEn1gm4/HLuna, but after I cloned it I noted that the comparison between the file compiled (using g++) from source, HLuna.cxx, and the ...
user avatar
  • 191
2 votes
2 answers
226 views

Committing encrypted passwords but not usernames

I’m arguing with a colleague about the security of storing encrypted password on GitHub. Our process is currently to commit a configuration file with environment variables including username and ...
user avatar
  • 129
2 votes
2 answers
276 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
user avatar
  • 121
6 votes
1 answer
571 views

How could malicious code changes in a GitHub pull request be masked by an attacker?

When viewing a pull request on GitHub (or the equivalent on any other platform), the web interface displays a diff of the changes for you to review. Reviewing the diff is obviously vulnerable to ...
user avatar
  • 425
1 vote
2 answers
171 views

How do I know exactly what type of information Github collects from a visitor?

I keep track of the upload bandwidth on every site that I visit, and I've noticed that the most site that uses upload bandwidth is Github.com every single page that I visit uploads 1.06MB of data. ...
user avatar
4 votes
2 answers
342 views

Should things like project IDs, cloud region IDs etc be kept secret on an open source project?

All my side project are open source - just using the free Github account. I'm wondering about how security conscious I need to be about keep things like: Google Cloud Platform Project IDs Log ...
user avatar
6 votes
2 answers
2k views

Is it safe to store GPG encrypted data publicly eg on GitHub?

I've been learning some basics of information security and GPG encryption and it's super intriguing. I wanted to understand vulnerabilities behind an idea that I had. After we create our public and ...
user avatar
  • 61
5 votes
2 answers
2k views

How can I verify signed commits made by other people?

As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
user avatar
2 votes
2 answers
652 views

Is it a good idea to upload your gnupg files to github?

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
user avatar
2 votes
3 answers
5k views

How to understand GitHub's password policy?

Today I tried to change my password on GitHub, but the site rejected my new password: The new password you provided has also been reported as compromised due to re-use of that password on another ...
user avatar
4 votes
2 answers
468 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
user avatar
14 votes
2 answers
3k views

Why are the gitlab SSH host key fingerprints not matching?

I tried to log into my university's gitlab via SSH. As expected, I was warned that the host is not known. Therefore, I tried to find the SSH host key on the "current configuration" page in the manual. ...
user avatar