Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [github]

github.com is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]

21
votes
3answers
8k views

Can I rely on these GitHub repository files?

I recently found the GitHub repository https://github.com/userEn1gm4/HLuna, but after I cloned it I noted that the comparison between the file compiled (using g++) from source, HLuna.cxx, and the ...
2
votes
2answers
96 views

Committing encrypted passwords but not usernames

I’m arguing with a colleague about the security of storing encrypted password on GitHub. Our process is currently to commit a configuration file with environment variables including username and ...
0
votes
2answers
34 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
6
votes
1answer
273 views

How could malicious code changes in a GitHub pull request be masked by an attacker?

When viewing a pull request on GitHub (or the equivalent on any other platform), the web interface displays a diff of the changes for you to review. Reviewing the diff is obviously vulnerable to ...
1
vote
2answers
121 views

How do I know exactly what type of information Github collects from a visitor?

I keep track of the upload bandwidth on every site that I visit, and I've noticed that the most site that uses upload bandwidth is Github.com every single page that I visit uploads 1.06MB of data. ...
3
votes
2answers
163 views

Should things like project IDs, cloud region IDs etc be kept secret on an open source project?

All my side project are open source - just using the free Github account. I'm wondering about how security conscious I need to be about keep things like: Google Cloud Platform Project IDs Log ...
4
votes
2answers
179 views

Is it safe to store GPG encrypted data publicly eg on GitHub?

I've been learning some basics of information security and GPG encryption and it's super intriguing. I wanted to understand vulnerabilities behind an idea that I had. After we create our public and ...
2
votes
1answer
103 views

How can I verify signed commits made by other people?

As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
2
votes
2answers
249 views

Is it a good idea to upload your gnupg files to github?

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
2
votes
3answers
933 views

How to understand GitHub's password policy?

Today I tried to change my password on GitHub, but the site rejected my new password: The new password you provided has also been reported as compromised due to re-use of that password on another ...
0
votes
0answers
55 views

How does Github authentication work (command line, api)?

I'm currently working on a project in which I have a tiny server which I am giving a friend root access to. I'm not worried about this, the server is disposable, if something goes wrong it can wipe ...
3
votes
2answers
96 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
12
votes
2answers
952 views

Why are the gitlab SSH host key fingerprints not matching?

I tried to log into my university's gitlab via SSH. As expected, I was warned that the host is not known. Therefore, I tried to find the SSH host key on the "current configuration" page in the manual. ...
0
votes
0answers
71 views

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
0
votes
1answer
144 views

How does Github preserve versioning integrity?

Given that a malicious party gains access to a GitHub repository, would it be possible for the adversary to delete or modify versioning information / history after she altered code stored on the repo? ...
2
votes
1answer
81 views

Sharing the UUIDs of my Linux partitions

I currently started using a Debian 9 server for my day-to-day tests. Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
0
votes
3answers
279 views

Why does Github need to offer a GPG signature feature?

Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
1
vote
1answer
100 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
-2
votes
2answers
110 views

How secure open source packages are? [closed]

When we clone git projects to use as is or when we install free npm packages provided by third party sources, is there any security risk? how trustworthy such packages are for production environment?
1
vote
2answers
214 views

What is the purpose of publishing the source of a web application? [closed]

I saw a lot of reports identifying security issues in big web applications based on some secret data deposited in Github public repositories. AFAIK, Github is a repository hosting service in which ...
2
votes
2answers
146 views

Why host third party libs instead of relying on CDN, Nuget, GitHub?

I'm struggling with some enterprise security guidelines requiring 3rd party libs to be hosted internally. The immediate concern is over our build server connecting to GitHub for package resolution, ...
23
votes
2answers
3k views

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab What is going on here?
-1
votes
1answer
488 views

API credentials visible when creating Github pages website?

I am in the planning stages of creating a rmarkdown website and publishing it using Github pages. The actual content of the website will be a flexdashboard or a Shiny app(still deciding). Regardless, ...
1
vote
0answers
60 views

Does GitHub have an endpoint for reading a users GPG keys? [closed]

Github produces a nice HTTP endpoint to read a users RSA keys. Do they have something like this for GPG keys (without needing additional auth or through the developer API)? If not why and/or when will ...
0
votes
1answer
453 views

GitHub pages and same origin

I am working with the security team at my work to get a website accredited before I can publish it...It is a very simple webpage hosted on Github pages with only some javascript. I kind of reached a ...
1
vote
2answers
485 views

Firefox presenting a Deceptive Site warning when trying to download a popular github resource. Should I ignore it?

I don't want to name names (in case it gets them some bad publicity for any party) however if there is a call for, then I can. I went to a website of a popular templating/framework system in order to ...