Github does a great job at implementing sane defaults but I understand the author's point - there can be a lot to do and you usually don't know you're even supposed to worry about this until way later when security auditors file like 9001 reports about your repo settings.
https://registry.terraform.io/providers/integrations/github/...
Phew.
It's not that hard. They just remove all of your agency as a user. You can push commits, open branches & pull requests, and merge if 2 people approve it. And that's it.
Want to merge? Restricted. Make a new repo? Restricted. Use a GitHub Action? Restricted. CODEOWNERS? Restricted. Branch filters? Restricted. Forks? Restricted. Releases, packages, artifacts, security, insights, settings, webhooks, environments, pages, wiki, issues? Restricted. Access a repo you aren't a member of? Restricted. Protected tags, dependency graph, dependabot, code scanning, secret scanning, deploy keys, secrets, github apps, oauth, notifications? Restricted. Stars? Restricted. And your SSO token expires every hour.
Can't get hacked if you can't do any work!
Boring, repetitive software development processes that prioritizes closing potential holes vs. speed of development. When you stop to think about it, explains quite a bit of why big companies are so slow to release?
Complete with the living modal upsell popup ala Medium. Will people ever learn? (No, no they won't)
Doesn't really seem like "a ton of work".
It'd be nicer if you managed to focus on the part of the Git/GitHub story: though, as a rant, it's perfectly fine :)
I'd say this link violates the rules. It says absolutely nothing new, it is shallow, has a popup.
The far you reach from GitHub's ecosystem, that's where most of the vulnerabilities are.
Repo-specific deploy keys, read-only keys and branch protection are my "pro" security hardening steps.
Shoving all secrets in ENV isn't a clear improvement either. Sure, most CI services attempt to mask them, but it's trivially to extract the secrets. For GitHub, you have to approve incoming first-time PRs, but it's a huge vector someone determined can exploit.
Kind of a rabbithole of energy!
* https://app.stepsecurity.io/securerepo * https://app.stepsecurity.io/
It also helps to go through the GitHub options to lock things down. Also, configure Dependabot to update "github-actions"
No affiliation. Just a happy user.
