Best practices to keep your projects secure on GitHub

Re:Best practices to keep your projects secure on GitHub by kevin_nisbet on Thursday April 28, 2022 @12:27PM (#31194560)

Article doesn't talk about much, just a bit on dependencies apparently from someone focused on supply chain security at Github.

At previous role, the more we looked at some of the technical controls around security within github itself, and had a number of security concerns. There's alot of nuance which is hard to go through and comment on, but the defaults and controls caused us lots of concern.

Here's a good writeup for anyone interested: https://cycode.com/blog/github-actions-vulnerabilities/

[ Parent | on HN ]

Re:Best practices to keep your projects secure on GitHub by jhutchings0 on Friday April 29, 2022 @05:48PM (#31210943)

Thanks for your comment! I'm Justin Hutchings, the author of that blog, and you're right that it was pretty narrowly focused on dependencies. We've been making a concerted effort to post about a number of security topics lately to provide best practices for users, everything from coordinated vulnerability disclosure, to how to protect from supply chain risks.

You can find all of our security related blogs here: https://github.blog/category/security/

And thanks for sharing that blog, I'll pass it along to my colleagues in the Actions team.

[ Parent | on HN ]