Skip to main content

Questions tagged [github] is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]

12 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2 votes
0 answers

Are there any risks associated with publishing AWS VPC ids, Subnet ids?

I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public. I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
knutole's user avatar
  • 121
2 votes
0 answers

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
gman's user avatar
  • 458
1 vote
1 answer

What can an attacker do with a stolen GitHub deploy key?

Let’s say I created a deploy key with write permissions to repository A. Let’s say repository A has a protected master branch that has " Require a pull request before merging " enabled and “...
1f604's user avatar
  • 11
1 vote
0 answers

What are the best practices pertaining to signing your git commits on GitHub?

On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits. However, in the scenario that the private key is exposed, the only option GitHub offers is ...
Private's user avatar
  • 115
1 vote
0 answers

How to verify a binary correctly even if my github account is hacked by someone

I have a binary file and saved it on github release page. To allow users to verify it, I saved sha256sum and signature(.asc). However I have a concern that if ...
zono's user avatar
  • 185
0 votes
1 answer

Is Git Bash Safe to Use on Windows?

I've recently downloaded and installed Git Bash for Windows, my primary goal is to use it for pushing code to GitHub. I already connect Gitbash with Github in browser ...
SirGhazian's user avatar
0 votes
0 answers

AWS Key stolen out of Github Actions / Secret Store

Do you have an idea how my AWS credentials could be stolen in the following setup: A 4 weeks old GitHub organization with 5 repositories & AWS Account AWS CI User Credentials with Administration ...
user1845948's user avatar
0 votes
1 answer

What does it mean if StackOverflow received OAUTH to access my GitHub account through the GitHub API?

I did not personally authorize StackOverflow to access my personal GitHub account through GitHub API, so what could this possibly mean?
EricBalingit's user avatar
0 votes
0 answers

OAuth Authorization Code for CLI

Trying to allow a CLI to "login" via web browser and obtain an access token for the user's account, similar to how gcloud and github's CLI do it. I realize it'll be using the OAuth ...
Sam's user avatar
  • 1
0 votes
0 answers

Packaging Python code for github: should I obfuscate author email address from the ``?

The standard file with packaging instructions ( with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
PlasmaBinturong's user avatar
0 votes
0 answers

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
reed's user avatar
  • 15.8k
-1 votes
1 answer

Infecting files on GitHub

Suppose one uploads (carelessly or purposefully) a file with a malicious payload to their Github account (some pdf document, picture, etc.). Could this payload somehow be executed on the Github ...
aleks1265's user avatar