NewsAgency

GitHub Security

Properties1
aliasesGitHub Security Best Practices, Repository Security

3 dakika okuma süresi

Definition

GitHub security encompasses the practices and features used to protect source code repositories, collaborative workflows, and development infrastructure from unauthorized access, data leaks, and supply chain attacks.

Public Monitoring (July 2026)

github Secret Scanning Public Monitoring public preview (July 1, 2026) (2026-07-01-github-secret-scanning-public-monitoring-changelog):

  • Scans all public GitHub content — repos, PRs, issues, discussions — for enterprise credentials
  • Real-time attribution via verified domains and identity graph
  • Free for Enterprise Cloud + Secret Protection/Advanced Security
  • Never scans private repositories

GitGuardian 2026: 29M new hardcoded secrets in public repos 2025 (+34% YoY). AI-co-authored commits leak secrets at ~2x baseline ( 2026-07-02-gitguardian-ai-commits-secret-leaks-2026).

Agentic Workflows Security (June 2026)

github Agentic Workflows public preview (June 11) adds layered agent security in ci-cd:

  • Read-only default permissions; no secrets in agent runtime
  • Agent Workflow Firewall + sandboxed containers
  • Safe outputs gate + threat detection on proposed changes
  • Compile-time validation (schema, expression allowlisting, action pinning)
  • Counter-narrative to agentjacking — platform-contained execution vs. local MCP trust chains

Key Security Features

  • Two-Factor Authentication (2FA): Additional login verification
  • Dependabot: Automated dependency vulnerability scanning
  • Code Scanning: Automated security analysis
  • Secret Scanning: Detection of exposed credentials
  • Access Controls: Role-based permissions

2026 Notable Incidents

npm v12 Security Defaults (June 9, 2026)

  • Policy shift: npm v12 (July 2026) blocks install scripts, Git deps, remote URL deps by default
  • Workflow: npm approve-scripts allowlist committed to package.json
  • Preparation: npm 11.16.0+ advisory warnings available now
  • Context: Direct response to miasma-worm and Shai-Hulud install-script exploitation
  • Lesson: GitHub/npm moving from implicit trust to explicit permission model

Microsoft GitHub Miasma Attack (June 5, 2026)

  • Attack Type: miasma-worm credential-harvesting via AI coding agent triggers
  • Vector: Reused durabletask contributor credentials → malicious commit to Azure/durabletask
  • Impact: 73 repos disabled across Azure, Azure-Samples, Microsoft, MicrosoftDocs
  • Trigger: Opening repo in Claude Code, Cursor, VS Code, Gemini CLI auto-executes payload
  • Response: GitHub disabled repos in 105-second automated sweep (HTTP 403 "reason": "tos")
  • Lesson: AI agent auto-execution creates new supply chain attack surface

Red Hat npm Miasma Attack (June 1, 2026)

  • Attack Type: GitHub Actions OIDC trusted publishing bypass
  • Vector: Compromised employee account → orphan commits → malicious workflows
  • Impact: 30+ @redhat-cloud-services packages with valid SLSA attestations
  • Lesson: OIDC trusted publishing is not immune to CI/CD pipeline compromise

MoneyForward GitHub Breach

  • Corporate GitHub account compromised
  • Source code and 370 records exfiltrated
  • Sensitive data stored on public/private repos

GitHub Copilot Training Policy

  • User interactions now used for AI training by default
  • Raises concerns about code confidentiality and IP

Best Practices

  1. Enable 2FA: Mandatory for all users
  2. Limit Access: Principle of least privilege
  3. Secret Management: Use environment variables, not hardcoded credentials
  4. Regular Audits: Review access logs and permissions
  5. Dependency Management: Keep packages updated
  6. Code Review: Mandatory peer review for changes

GitHub Security vs Development Workflow

GitHub’s integration into development workflows creates tension between:

  • Collaboration: Open contribution models
  • Security: Restricted access and review

Sources

Grafik Görünümü

Backlinkler