Questions tagged [github] is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]

Filter by
Sorted by
Tagged with
2 votes
2 answers

Committing encrypted passwords but not usernames

I’m arguing with a colleague about the security of storing encrypted password on GitHub. Our process is currently to commit a configuration file with environment variables including username and ...
gurghet's user avatar
  • 129
2 votes
2 answers

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
Hay's user avatar
  • 121
6 votes
1 answer

How could malicious code changes in a GitHub pull request be masked by an attacker?

When viewing a pull request on GitHub (or the equivalent on any other platform), the web interface displays a diff of the changes for you to review. Reviewing the diff is obviously vulnerable to ...
jamieweb's user avatar
  • 435
1 vote
2 answers

How do I know exactly what type of information Github collects from a visitor?

I keep track of the upload bandwidth on every site that I visit, and I've noticed that the most site that uses upload bandwidth is every single page that I visit uploads 1.06MB of data. ...
Yousef Al-Hadhrami's user avatar
3 votes
2 answers

Should things like project IDs, cloud region IDs etc be kept secret on an open source project?

All my side project are open source - just using the free Github account. I'm wondering about how security conscious I need to be about keep things like: Google Cloud Platform Project IDs Log ...
dwjohnston's user avatar
6 votes
2 answers

Is it safe to store GPG encrypted data publicly eg on GitHub?

I've been learning some basics of information security and GPG encryption and it's super intriguing. I wanted to understand vulnerabilities behind an idea that I had. After we create our public and ...
ggoober's user avatar
  • 61
6 votes
2 answers

How can I verify signed commits made by other people?

As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
Brendan Roy's user avatar
2 votes
2 answers

Is it a good idea to upload your gnupg files to github?

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
omkar joglekar's user avatar
2 votes
3 answers

How to understand GitHub's password policy?

Today I tried to change my password on GitHub, but the site rejected my new password: The new password you provided has also been reported as compromised due to re-use of that password on another ...
Colonel Panic's user avatar
4 votes
2 answers

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
Sai Dutt Mekala's user avatar
14 votes
2 answers

Why are the gitlab SSH host key fingerprints not matching?

I tried to log into my university's gitlab via SSH. As expected, I was warned that the host is not known. Therefore, I tried to find the SSH host key on the "current configuration" page in the manual. ...
HerpDerpington's user avatar
0 votes
0 answers

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
reed's user avatar
  • 15.7k
0 votes
1 answer

How does Github preserve versioning integrity?

Given that a malicious party gains access to a GitHub repository, would it be possible for the adversary to delete or modify versioning information / history after she altered code stored on the repo? ...
user1192748's user avatar
3 votes
1 answer

Sharing the UUIDs of my Linux partitions

I currently started using a Debian 9 server for my day-to-day tests. Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
Lemon's user avatar
  • 133
2 votes
3 answers

Why does Github need to offer a GPG signature feature?

Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
0x90's user avatar
  • 1,422
1 vote
1 answer

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
TheSabby's user avatar
-2 votes
2 answers

How secure open source packages are? [closed]

When we clone git projects to use as is or when we install free npm packages provided by third party sources, is there any security risk? how trustworthy such packages are for production environment?
Priyanka Desai's user avatar
1 vote
2 answers

What is the purpose of publishing the source of a web application? [closed]

I saw a lot of reports identifying security issues in big web applications based on some secret data deposited in Github public repositories. AFAIK, Github is a repository hosting service in which ...
Reda LM's user avatar
  • 367
2 votes
2 answers

Why host third party libs instead of relying on CDN, Nuget, GitHub?

I'm struggling with some enterprise security guidelines requiring 3rd party libs to be hosted internally. The immediate concern is over our build server connecting to GitHub for package resolution, ...
ajamrozek's user avatar
50 votes
2 answers

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

This commit in my GiHub repo is signed by a key I don't recognize: What is going on here?
Jonathan Cross's user avatar
0 votes
1 answer

API credentials visible when creating Github pages website?

I am in the planning stages of creating a rmarkdown website and publishing it using Github pages. The actual content of the website will be a flexdashboard or a Shiny app(still deciding). Regardless, ...
Kyle Weise's user avatar
1 vote
0 answers

Does GitHub have an endpoint for reading a users GPG keys? [closed]

Github produces a nice HTTP endpoint to read a users RSA keys. Do they have something like this for GPG keys (without needing additional auth or through the developer API)? If not why and/or when will ...
cmcginty's user avatar
  • 111
0 votes
1 answer

GitHub pages and same origin

I am working with the security team at my work to get a website accredited before I can publish it...It is a very simple webpage hosted on Github pages with only some javascript. I kind of reached a ...
mireille raad's user avatar
1 vote
2 answers

Firefox presenting a Deceptive Site warning when trying to download a popular github resource. Should I ignore it?

I don't want to name names (in case it gets them some bad publicity for any party) however if there is a call for, then I can. I went to a website of a popular templating/framework system in order to ...
Crazy Dino's user avatar
  • 1,527