Questions tagged [github]
github.com is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]
74
questions
2
votes
2
answers
296
views
Committing encrypted passwords but not usernames
I’m arguing with a colleague about the security of storing encrypted password on GitHub.
Our process is currently to commit a configuration file with environment variables including username and ...
- 129
2
votes
2
answers
373
views
Confused about GitHub's GPG key association and authenticity
I'm not sure I understand GPG, and something on GitHub has left me wondering.
In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
- 121
6
votes
1
answer
690
views
How could malicious code changes in a GitHub pull request be masked by an attacker?
When viewing a pull request on GitHub (or the equivalent on any other platform), the web interface displays a diff of the changes for you to review.
Reviewing the diff is obviously vulnerable to ...
- 435
1
vote
2
answers
183
views
How do I know exactly what type of information Github collects from a visitor?
I keep track of the upload bandwidth on every site that I visit, and I've noticed that the most site that uses upload bandwidth is Github.com
every single page that I visit uploads 1.06MB of data.
...
3
votes
2
answers
556
views
Should things like project IDs, cloud region IDs etc be kept secret on an open source project?
All my side project are open source - just using the free Github account.
I'm wondering about how security conscious I need to be about keep things like:
Google Cloud Platform Project IDs
Log ...
- 717
6
votes
2
answers
3k
views
Is it safe to store GPG encrypted data publicly eg on GitHub?
I've been learning some basics of information security and GPG encryption and it's super intriguing. I wanted to understand vulnerabilities behind an idea that I had.
After we create our public and ...
- 61
6
votes
2
answers
3k
views
How can I verify signed commits made by other people?
As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
- 163
2
votes
2
answers
952
views
Is it a good idea to upload your gnupg files to github?
I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
2
votes
3
answers
5k
views
How to understand GitHub's password policy?
Today I tried to change my password on GitHub, but the site rejected my new password:
The new password you provided has also been reported as compromised due to re-use of that password on another ...
- 2,144
4
votes
2
answers
514
views
Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github
I have been working on a code review of a project. The source code is publicly available on Github.
I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
- 343
14
votes
2
answers
3k
views
Why are the gitlab SSH host key fingerprints not matching?
I tried to log into my university's gitlab via SSH. As expected, I was warned that the host is not known. Therefore, I tried to find the SSH host key on the "current configuration" page in the manual. ...
- 225
0
votes
0
answers
137
views
How should security patches be managed in public versioning systems (like Github, etc.)?
There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
- 15.7k
0
votes
1
answer
378
views
How does Github preserve versioning integrity?
Given that a malicious party gains access to a GitHub repository, would it be possible for the adversary to delete or modify versioning information / history after she altered code stored on the repo? ...
- 283
3
votes
1
answer
589
views
Sharing the UUIDs of my Linux partitions
I currently started using a Debian 9 server for my day-to-day tests.
Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
- 133
2
votes
3
answers
3k
views
Why does Github need to offer a GPG signature feature?
Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
- 1,422
1
vote
1
answer
212
views
Making an API repository private vs public
So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
- 13
-2
votes
2
answers
153
views
How secure open source packages are? [closed]
When we clone git projects to use as is or when we install free npm packages provided by third party sources, is there any security risk? how trustworthy such packages are for production environment?
1
vote
2
answers
264
views
What is the purpose of publishing the source of a web application? [closed]
I saw a lot of reports identifying security issues in big web applications based on some secret data deposited in Github public repositories.
AFAIK, Github is a repository hosting service in which ...
- 367
2
votes
2
answers
338
views
Why host third party libs instead of relying on CDN, Nuget, GitHub?
I'm struggling with some enterprise security guidelines requiring 3rd party libs to be hosted internally. The immediate concern is over our build server connecting to GitHub for package resolution, ...
- 21
50
votes
2
answers
13k
views
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab
What is going on here?
- 1,680
0
votes
1
answer
1k
views
API credentials visible when creating Github pages website?
I am in the planning stages of creating a rmarkdown website and publishing it using Github pages. The actual content of the website will be a
flexdashboard or a Shiny app(still deciding). Regardless, ...
- 111
1
vote
0
answers
116
views
Does GitHub have an endpoint for reading a users GPG keys? [closed]
Github produces a nice HTTP endpoint to read a users RSA keys. Do they have something like this for GPG keys (without needing additional auth or through the developer API)? If not why and/or when will ...
- 111
0
votes
1
answer
2k
views
GitHub pages and same origin
I am working with the security team at my work to get a website accredited before I can publish it...It is a very simple webpage hosted on Github pages with only some javascript.
I kind of reached a ...
- 101
1
vote
2
answers
675
views
Firefox presenting a Deceptive Site warning when trying to download a popular github resource. Should I ignore it?
I don't want to name names (in case it gets them some bad publicity for any party) however if there is a call for, then I can.
I went to a website of a popular templating/framework system in order to ...
- 1,527