Re:Security alerts on GitHub
by thesmallestcat on Thursday November 16, 2017 @06:23PM
(#15717622)
Think carefully about the consequences of this automated scan info leaking before enabling it in your private repositories.
[ Parent
| on HN ]
Are the consequences significantly different than having private repos on Github to begin with?
I realize this is one more Github service with access to metadata about your code, so the attack surface is technically larger, but is the probability of leak that much greater from this service than it already is by having your code on their servers (which, I assume, are protected by the same security team)?
Maybe it's an oversimplification but my expectation is that any project with such sensitivity wouldn't be hosted on an external service at all.