Questions tagged [github]

github.com is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]

10 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2 votes
0 answers
354 views

Are there any risks associated with publishing AWS VPC ids, Subnet ids?

I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public. I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
knutole's user avatar
  • 121
2 votes
0 answers
375 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
gman's user avatar
  • 458
1 vote
1 answer
176 views

What can an attacker do with a stolen GitHub deploy key?

Let’s say I created a deploy key with write permissions to repository A. Let’s say repository A has a protected master branch that has " Require a pull request before merging " enabled and “...
1f604's user avatar
  • 11
1 vote
0 answers
295 views

What are the best practices pertaining to signing your git commits on GitHub?

On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits. However, in the scenario that the private key is exposed, the only option GitHub offers is ...
Private's user avatar
  • 115
1 vote
0 answers
131 views

How to verify a binary correctly even if my github account is hacked by someone

I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases To allow users to verify it, I saved sha256sum and signature(.asc). However I have a concern that if ...
zono's user avatar
  • 185
0 votes
1 answer
176 views

What does it mean if StackOverflow received OAUTH to access my GitHub account through the GitHub API?

I did not personally authorize StackOverflow to access my personal GitHub account through GitHub API, so what could this possibly mean?
EricBalingit's user avatar
0 votes
0 answers
58 views

OAuth Authorization Code for CLI

Trying to allow a CLI to "login" via web browser and obtain an access token for the user's account, similar to how gcloud and github's CLI do it. I realize it'll be using the OAuth ...
Sam's user avatar
  • 1
0 votes
0 answers
378 views

Packaging Python code for github: should I obfuscate author email address from the `setup.py`?

The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
PlasmaBinturong's user avatar
0 votes
0 answers
137 views

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
reed's user avatar
  • 15.7k
-1 votes
1 answer
344 views

Infecting files on GitHub

Suppose one uploads (carelessly or purposefully) a file with a malicious payload to their Github account (some pdf document, picture, etc.). Could this payload somehow be executed on the Github ...
aleks1265's user avatar