Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [github]

github.com is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]

Filter by
Sorted by
Tagged with
0 votes
0 answers
64 views

AWS Key stolen out of Github Actions / Secret Store

Do you have an idea how my AWS credentials could be stolen in the following setup: A 4 weeks old GitHub organization with 5 repositories & AWS Account AWS CI User Credentials with Administration ...
user1845948's user avatar
1 vote
2 answers
100 views

Is it safe to keep a JDBC SQLite URI in source code?

If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI? Should I replace the name of the SQLite db with code to ...
Setu Kumar Basak's user avatar
-1 votes
1 answer
180 views

How does github save files?

If I create a malicious .pdf file and upload it to github, this file can be exploited when processed in a program, right? What about a .MD file where there is only text? I guess that it can also be ...
ojo's user avatar
  • 29
1 vote
1 answer
2k views

AWS RDS Database access from Github Actions

I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS. The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
Jöcker's user avatar
  • 111
0 votes
1 answer
251 views

What does it mean if StackOverflow received OAUTH to access my GitHub account through the GitHub API?

I did not personally authorize StackOverflow to access my personal GitHub account through GitHub API, so what could this possibly mean?
EricBalingit's user avatar
1 vote
1 answer
225 views

Is using an existing personal GitHub account for professional work not SOC compliant?

My manager is asking me to create a new, separate GitHub personal account for work, using my company email address. This comes with setup complications for me. I have worked with big, governmental ...
Matyas's user avatar
  • 13
2 votes
1 answer
205 views

Git Remote Code Execution vulnerabilities as of January 17, 2023

GitHub Blog: https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2 Git has 3 new Remote Code Execution vulnerabilities. It's said in the blog that Git was already patched by version ...
Leandro's user avatar
  • 21
0 votes
0 answers
102 views

OAuth Authorization Code for CLI

Trying to allow a CLI to "login" via web browser and obtain an access token for the user's account, similar to how gcloud and github's CLI do it. I realize it'll be using the OAuth ...
Sam's user avatar
  • 1
3 votes
1 answer
417 views

Does ISO27001 require to use Github Enterprise Single Sign on?

A Company would like to get ISO 271001 certified. With 10 developers and 4 others (product, QA) having access to various Github Repositories, they managed their access rights pretty good. 3 people ...
Tim Kretschmer's user avatar
0 votes
1 answer
247 views

Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?

I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
Mike Strutter's user avatar
0 votes
1 answer
78 views

What is the two_factor_authentication.recovery_codes_regenerated security event in the GutHub account

I made some changes to my GitHub account security, notably I added two new hardware security keys and removed SMS as a 2FA backup method. 8 days later today, I randomly checked the GitHub's own ...
Marty Cagas's user avatar
0 votes
1 answer
278 views

Why is the fix for CVE-2022-0839 on a test class?

I am analyzing CVE-2022-0839. When checking the commit, I don't understand why the commit is on a test class. I mean, how does a test class fix a vulnerable component? shouldn't the fix be done in the ...
ethicalhacker's user avatar
0 votes
1 answer
361 views

Do git commit signatures reveal key uid if different from git email?

I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. ...
ahmedsabriz's user avatar
2 votes
3 answers
2k views

Employee uploaded proprietary private repository on his github public account

A newly joined software engineer in our organization uploaded one of company's proprietary git repository on his personal Github public account, likely without nefarious intent. How do I ensure this ...
Abhinav's user avatar
  • 179
1 vote
1 answer
248 views

What can an attacker do with a stolen GitHub deploy key?

Let’s say I created a deploy key with write permissions to repository A. Let’s say repository A has a protected master branch that has " Require a pull request before merging " enabled and “...
1f604's user avatar
  • 11
0 votes
0 answers
170 views

What is GitHub authentication SDT ? And why is it sending OTP from a residential number? [duplicate]

I had enabled 2FA for GitHub using a mobile number. Today when I tried to log in from a different device, during the 2FA verification time, I received the code from a consumer phone number [ +91 ...
Amlan Saha Kundu's user avatar
-1 votes
1 answer
404 views

Infecting files on GitHub

Suppose one uploads (carelessly or purposefully) a file with a malicious payload to their Github account (some pdf document, picture, etc.). Could this payload somehow be executed on the Github ...
aleks1265's user avatar
1 vote
1 answer
470 views

SSH to github.com only adds RSA keys - excludes ed25519 host keys

I am doing some tests around ssh. From what I have seen a server usually has multiple host keys. When a client tries to connect, it tries to negotiate which key types to use DSA, RSA, ECDSA, etc. But ...
sergiu reznicencu's user avatar
0 votes
0 answers
26 views

Publish public GPG key on GitHub [duplicate]

Is it safe to publish your public GPG keys on GitHub? And link to them in the signature of the e-mails you send, together with the fingerprint after the link?
robertspierre's user avatar
-1 votes
2 answers
195 views

I accidentally clicked on ransomware link. Antivirus cleaned the files successfully

I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...
timothylim_12345's user avatar
0 votes
2 answers
481 views

Secure way to set up GitHub repository in shared remote machine

I have access to a shared remote machine to execute code and store data, accessible through SSH from my local machine, but I do not have root privileges there. The remote is shared among many users. I ...
lucasresck's user avatar
0 votes
1 answer
3k views

Using Github's Public IP Address as Remote URL

My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github. Some IT departments have github blocked on ...
user2437443's user avatar
2 votes
1 answer
2k views

Is it possible to find the owner of a GitHub Pages site that is connected to a custom domain?

I am curious whether someone could find out if a site hosted on GitHub Pages could be traced back to the user that published it. This is of course, assuming that: the GitHub repository containing the ...
Mysterio's user avatar
0 votes
1 answer
159 views

Github.com token authorisation since 13th August, impractical?

Gihub removed password authentication: remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information. fatal: unable to access 'https://...
run_the_race's user avatar
1 vote
0 answers
348 views

What are the best practices pertaining to signing your git commits on GitHub?

On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits. However, in the scenario that the private key is exposed, the only option GitHub offers is ...
Private's user avatar
  • 115
107 votes
4 answers
15k views

Suspicious GitHub fork

Update (April 15): The forked repo and the user do not exist any more. Yesterday, one of my GitHub projects was forked and there is a suspicious commit on the fork of the repo. As you can see from the ...
Giorgi's user avatar
  • 913
2 votes
0 answers
546 views

Are there any risks associated with publishing AWS VPC ids, Subnet ids?

I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public. I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
knutole's user avatar
  • 121
4 votes
0 answers
2k views

Is github1s.com safe ? How does it work? [closed]

My colleagues started using https://github1s.com to browse our company's code on Github. It pops a "visual studio" window for the code. Looks great and useful. But... I don't know much about ...
Jeffrey's user avatar
  • 141
2 votes
2 answers
381 views

How is a DNS wildcard a security issue for GitHub Pages?

GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so: GitHub must be set up to recognize that an ...
WoJ's user avatar
  • 9,038
1 vote
1 answer
165 views

How does one tighten up their git repo security for Powershell?

Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after ...
leeand00's user avatar
  • 1,441
6 votes
2 answers
1k views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
mYnDstrEAm's user avatar
3 votes
1 answer
2k views

Fingerprints of a RSA keys - GitHub not matching?

I am wondering how those RSA fingerprints work. I have a GitHub account and created an RSA key pair to set up an ssh connection. Then followed the instruction... First time I connect to my GitHub it ...
LeonSteinn's user avatar
0 votes
1 answer
159 views

How to store Personal Access Token securely on shared machine

We have a shared machine in the office, used for demo'ing our product. I want to be able to fetch the latest code from Github. We have 2FA enabled, so I can't use my login password for https ...
AShelly's user avatar
  • 173
1 vote
2 answers
363 views

Solutions for backing-up my codebase

I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
undecided's user avatar
2 votes
1 answer
589 views

What are the security risks if my server with github ssh access key is hacked?

I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS. If a hacker gains access to this AWS server, ...
simplfuzz's user avatar
  • 221
6 votes
1 answer
4k views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
Zak's user avatar
  • 163
0 votes
2 answers
709 views

Github private repo safe from scrapers?

I have a question about the security of private repo's on Github. Assume you use HTTPS authenticated against SAML SSO to fetch and push changes to remote. Could an outside adversary scrape the files ...
Irix-Steve's user avatar
0 votes
0 answers
434 views

Packaging Python code for github: should I obfuscate author email address from the `setup.py`?

The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
PlasmaBinturong's user avatar
5 votes
1 answer
2k views

Risks of allowing employees using personal GitHub accounts for work

Proprietary software developed by a (smallish) company is stored in the company's GitHub private repository. For work, software engineers are requested to create company-specific GitHub account bound ...
Konstantin Shemyak's user avatar
3 votes
1 answer
415 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
CCJ's user avatar
  • 133
1 vote
0 answers
232 views

Recruiter pretends to have found my e-mail address through GitHub account. How to check if this is true? [closed]

A recruiter directly e-mailed me about a job offer and pretended to have found the e-mail address via my GitHub account. Normally I receive e-mails via LinkedIn and almost never directly, as I try my ...
Alexei's user avatar
  • 2,193
2 votes
0 answers
408 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
gman's user avatar
  • 458
2 votes
1 answer
228 views

Webhook Security

I'm following this guide on: How to set up CI/CD Pipeline for a node.js app with Jenkins I've installed Jenkins on a VPS and I can access the Web UI over an SSH Tunnel. Then I saw this: http://...
coverflower's user avatar
2 votes
1 answer
328 views

Suspicious GitHub mirror site (https://hzb.world/)

Through some odd Google rabbit hole, I ended up at what appeared to be the GitHub website. I reflexively tried logging in to view my repositories. Upon attempting to log in, it said my browser did ...
Colin Basnett's user avatar
1 vote
0 answers
153 views

How to verify a binary correctly even if my github account is hacked by someone

I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases To allow users to verify it, I saved sha256sum and signature(.asc). However I have a concern that if ...
zono's user avatar
  • 185
1 vote
1 answer
658 views

Is it safe to use Giphy API keys in public Github repo?

I am making a game of which one of the hidden features is displaying a GIF from Giphy at a fixed command. For this, I am using Giphy API, hosting the game as a website on Github Pages with a public ...
Eagle's user avatar
  • 115
1 vote
2 answers
2k views

Should I delete lost GPG key from GitHub?

I've been using GPG key for a while to sign commits on GitHub. However, I recently lost it by accident when moving data around. It haven't leaked anywhere and signed commits can be trusted, I just don'...
val - disappointed in SE's user avatar
8 votes
1 answer
3k views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
ShapeOfMatter's user avatar
171 votes
4 answers
45k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
Stefan Gabos's user avatar
  • 1,103
19 votes
1 answer
5k views

Github account hacked and repo wiped - Github Response

One of my repo's was wiped today and just a message left in its place with a bitcoin ransom. I've no idea how they accessed my account, can't really see anything on github security page. The domain of ...
Raymie's user avatar
  • 191