Questions tagged [github]
github.com is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]
74
questions
1
vote
2
answers
52
views
Is it safe to keep a JDBC SQLite URI in source code?
If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI?
Should I replace the name of the SQLite db with code to ...
- 164
1
vote
1
answer
175
views
What can an attacker do with a stolen GitHub deploy key?
Let’s say I created a deploy key with write permissions to repository A.
Let’s say repository A has a protected master branch that has " Require a pull request before merging " enabled and “...
CommunityBot
- 1
1
vote
2
answers
310
views
Solutions for backing-up my codebase
I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
CommunityBot
- 1
0
votes
1
answer
175
views
What does it mean if StackOverflow received OAUTH to access my GitHub account through the GitHub API?
I did not personally authorize StackOverflow to access my personal GitHub account through GitHub API, so what could this possibly mean?
CommunityBot
- 1
-1
votes
1
answer
113
views
How does github save files?
If I create a malicious .pdf file and upload it to github, this file can be exploited when processed in a program, right?
What about a .MD file where there is only text? I guess that it can also be ...
- 19
1
vote
1
answer
1k
views
AWS RDS Database access from Github Actions
I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS.
The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
- 111
0
votes
2
answers
642
views
Github private repo safe from scrapers?
I have a question about the security of private repo's on Github. Assume you use HTTPS authenticated against SAML SSO to fetch and push changes to remote. Could an outside adversary scrape the files ...
- 1
2
votes
1
answer
300
views
Suspicious GitHub mirror site (https://hzb.world/)
Through some odd Google rabbit hole, I ended up at what appeared to be the GitHub website. I reflexively tried logging in to view my repositories. Upon attempting to log in, it said my browser did ...
CommunityBot
- 1
1
vote
1
answer
144
views
Is using an existing personal GitHub account for professional work not SOC compliant?
My manager is asking me to create a new, separate GitHub personal account for work, using my company email address. This comes with setup complications for me.
I have worked with big, governmental ...
- 128k
2
votes
1
answer
162
views
Git Remote Code Execution vulnerabilities as of January 17, 2023
GitHub Blog: https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2
Git has 3 new Remote Code Execution vulnerabilities.
It's said in the blog that Git was already patched by version ...
- 18.8k
0
votes
1
answer
208
views
Why is the fix for CVE-2022-0839 on a test class?
I am analyzing CVE-2022-0839.
When checking the commit, I don't understand why the commit is on a test class. I mean, how does a test class fix a vulnerable component? shouldn't the fix be done in the ...
CommunityBot
- 1
0
votes
0
answers
57
views
OAuth Authorization Code for CLI
Trying to allow a CLI to "login" via web browser and obtain an access token for the user's account, similar to how gcloud and github's CLI do it. I realize it'll be using the OAuth ...
- 128k
3
votes
1
answer
271
views
Does ISO27001 require to use Github Enterprise Single Sign on?
A Company would like to get ISO 271001 certified.
With 10 developers and 4 others (product, QA) having access to various Github Repositories, they managed their access rights pretty good. 3 people ...
- 36
0
votes
1
answer
201
views
Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?
I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
- 53.5k
0
votes
1
answer
41
views
What is the two_factor_authentication.recovery_codes_regenerated security event in the GutHub account
I made some changes to my GitHub account security, notably I added two new hardware security keys and removed SMS as a 2FA backup method.
8 days later today, I randomly checked the GitHub's own ...
- 224
0
votes
1
answer
262
views
Do git commit signatures reveal key uid if different from git email?
I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. ...
- 111
50
votes
2
answers
13k
views
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab
What is going on here?
- 1
0
votes
3
answers
1k
views
Employee uploaded proprietary private repository on his github public account
A newly joined software engineer in our organization uploaded one of company's proprietary git repository on his personal Github public account, likely without nefarious intent.
How do I ensure this ...
- 484
0
votes
0
answers
114
views
What is GitHub authentication SDT ? And why is it sending OTP from a residential number? [duplicate]
I had enabled 2FA for GitHub using a mobile number. Today when I tried to log in from a different device, during the 2FA verification time, I received the code from a consumer phone number [ +91 ...
- 128k
-1
votes
1
answer
342
views
Infecting files on GitHub
Suppose one uploads (carelessly or purposefully) a file with a malicious payload to their Github account (some pdf document, picture, etc.). Could this payload somehow be executed on the Github ...
- 2,552
2
votes
1
answer
504
views
What are the security risks if my server with github ssh access key is hacked?
I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS.
If a hacker gains access to this AWS server, ...
CommunityBot
- 1
1
vote
1
answer
383
views
SSH to github.com only adds RSA keys - excludes ed25519 host keys
I am doing some tests around ssh. From what I have seen a server usually has multiple host keys. When a client tries to connect, it tries to negotiate which key types to use DSA, RSA, ECDSA, etc. But ...
- 9,294
0
votes
0
answers
23
views
Publish public GPG key on GitHub [duplicate]
Is it safe to publish your public GPG keys on GitHub?
And link to them in the signature of the e-mails you send, together with the fingerprint after the link?
- 517
-1
votes
2
answers
159
views
I accidentally clicked on ransomware link. Antivirus cleaned the files successfully
I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...
- 49.3k
0
votes
2
answers
369
views
Secure way to set up GitHub repository in shared remote machine
I have access to a shared remote machine to execute code and store data, accessible through SSH from my local machine, but I do not have root privileges there. The remote is shared among many users. I ...
- 1,366
0
votes
1
answer
2k
views
Using Github's Public IP Address as Remote URL
My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github.
Some IT departments have github blocked on ...
- 135k
1
vote
1
answer
1k
views
Is it possible to find the owner of a GitHub Pages site that is connected to a custom domain?
I am curious whether someone could find out if a site hosted on GitHub Pages could be traced back to the user that published it. This is of course, assuming that:
the GitHub repository containing the ...
- 1,316
0
votes
1
answer
132
views
Github.com token authorisation since 13th August, impractical?
Gihub removed password authentication:
remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information.
fatal: unable to access 'https://...
- 714
1
vote
0
answers
294
views
What are the best practices pertaining to signing your git commits on GitHub?
On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits.
However, in the scenario that the private key is exposed, the only option GitHub offers is ...
- 115
108
votes
4
answers
15k
views
Suspicious GitHub fork
Update (April 15): The forked repo and the user do not exist any more.
Yesterday, one of my GitHub projects was forked and there is a suspicious commit on the fork of the repo. As you can see from the ...
- 350
2
votes
0
answers
353
views
Are there any risks associated with publishing AWS VPC ids, Subnet ids?
I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public.
I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
- 121
4
votes
0
answers
2k
views
Is github1s.com safe ? How does it work? [closed]
My colleagues started using https://github1s.com to browse our company's code on Github. It pops a "visual studio" window for the code. Looks great and useful.
But... I don't know much about ...
- 128k
1
vote
1
answer
564
views
Is it safe to use Giphy API keys in public Github repo?
I am making a game of which one of the hidden features is displaying a GIF from Giphy at a fixed command. For this, I am using Giphy API, hosting the game as a website on Github Pages with a public ...
- 136
2
votes
2
answers
339
views
How is a DNS wildcard a security issue for GitHub Pages?
GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so:
GitHub must be set up to recognize that an ...
- 9,028
1
vote
1
answer
143
views
How does one tighten up their git repo security for Powershell?
Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after ...
- 12.2k
5
votes
2
answers
1k
views
How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?
To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page.
Sometimes, at least here, the hashsum are made part ...
- 384
3
votes
1
answer
2k
views
Fingerprints of a RSA keys - GitHub not matching?
I am wondering how those RSA fingerprints work. I have a GitHub account and created an RSA key pair to set up an ssh connection. Then followed the instruction...
First time I connect to my GitHub it ...
- 500
0
votes
1
answer
134
views
How to store Personal Access Token securely on shared machine
We have a shared machine in the office, used for demo'ing our product.
I want to be able to fetch the latest code from Github.
We have 2FA enabled, so I can't use my login password for https ...
- 11.5k
172
votes
4
answers
45k
views
GitLab account hacked and repo wiped
I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying
To recover your lost code and avoid leaking it: Send us 0.1 ...
- 521
6
votes
2
answers
3k
views
How can I verify signed commits made by other people?
As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
- 1
6
votes
1
answer
3k
views
Recover lost GPG public key
I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it.
...
- 484
0
votes
0
answers
377
views
Packaging Python code for github: should I obfuscate author email address from the `setup.py`?
The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
- 151
5
votes
1
answer
2k
views
Risks of allowing employees using personal GitHub accounts for work
Proprietary software developed by a (smallish) company is stored in the company's GitHub private repository. For work, software engineers are requested to create company-specific GitHub account bound ...
3
votes
1
answer
378
views
What security concerns are there for a fully client-side JS/HTML5 app?
I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
- 437
1
vote
0
answers
204
views
Recruiter pretends to have found my e-mail address through GitHub account. How to check if this is true? [closed]
A recruiter directly e-mailed me about a job offer and pretended to have found the e-mail address via my GitHub account. Normally I receive e-mails via LinkedIn and almost never directly, as I try my ...
- 2,183
2
votes
0
answers
374
views
How are github personal access tokens and other github auth for 3rd parties not a securty issue?
Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
- 458
2
votes
1
answer
176
views
Webhook Security
I'm following this guide on:
How to set up CI/CD Pipeline for a node.js app with Jenkins
I've installed Jenkins on a VPS and I can access the Web UI over an SSH Tunnel. Then I saw this:
http://...
- 5,100
19
votes
1
answer
5k
views
Github account hacked and repo wiped - Github Response
One of my repo's was wiped today and just a message left in its place with a bitcoin ransom. I've no idea how they accessed my account, can't really see anything on github security page.
The domain of ...
CommunityBot
- 1
1
vote
0
answers
131
views
How to verify a binary correctly even if my github account is hacked by someone
I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases
To allow users to verify it, I saved sha256sum and signature(.asc).
However I have a concern that if ...
- 185
1
vote
2
answers
2k
views
Should I delete lost GPG key from GitHub?
I've been using GPG key for a while to sign commits on GitHub. However, I recently lost it by accident when moving data around. It haven't leaked anywhere and signed commits can be trusted, I just don'...
- 7,858