Re:Securing a GitHub repo is a ton of work
by Ayesh on Friday October 21, 2022 @02:50AM
(#33285252)
GitHub does a pretty good job requiring oauth or ssh key authentication, and the new finely-grained personal access are awesome, I just switched all my apps to use more locked down PATs.
The far you reach from GitHub's ecosystem, that's where most of the vulnerabilities are.
Repo-specific deploy keys, read-only keys and branch protection are my "pro" security hardening steps.
Shoving all secrets in ENV isn't a clear improvement either. Sure, most CI services attempt to mask them, but it's trivially to extract the secrets. For GitHub, you have to approve incoming first-time PRs, but it's a huge vector someone determined can exploit.
The far you reach from GitHub's ecosystem, that's where most of the vulnerabilities are.
Repo-specific deploy keys, read-only keys and branch protection are my "pro" security hardening steps.
Shoving all secrets in ENV isn't a clear improvement either. Sure, most CI services attempt to mask them, but it's trivially to extract the secrets. For GitHub, you have to approve incoming first-time PRs, but it's a huge vector someone determined can exploit.