Table of Contents
GitHub – is my code Secure?
Starting adventure with repository hosting services? So you probably heard about GitHub! You might wonder about GitHub security and whether it is a secure place to host your repositories and related source code within this service. For companies for which source code is one of the most valuable assets, the security aspect of such services might be a game-changer. We can not give you a straightforward answer – no service provider can guarantee a 100% uptime but GitHub is considered a reliable and proven platform with many security solutions in place. Let’s check them out!
GitHub, Security of my Repository
Note that the riskiest situations result from credential compromising, so the first line of defense is authentication. So first of all, GitHub recommends using a password manager to create a secure and unique password. Additionally, it is recommended to use two-factor authentication (2FA). In this situation, we can use a mobile application or SMS, thanks to which, in addition to the password, we will also provide a special code. As a result, even if someone learns our password, they will not be able to log into our account without the device we have with us.
Some of the riskiest situations result from credential compromising, so proper authentication is key. GitHub recommends having a password manager that will suggest a strong and unique password for our account. It’s good to have two-factor authentication and mobile app or SMS codes as the second layer of credentials security.
GitHub allows us to generate a Personal Access Token that can be used instead of the password for repository integration. Difference? The token may be set for some accurate period of time – for example five hours, a week, month or simply as long as you need. Moreover, you can set a number of operations possible to perform with this token. You no longer have to remember to revoke permissions once the job is ended, the token will expire itself and further access will be completely impossible.
There is always some risk of communication being overheard or intercepted by cybercriminals. How to minimize it? It is important to resign from HTTPS communication. Why? Isn’t it considered safe? Well, indeed but the SSH connection is a better option. Thanks to this, the connection is encrypted. The protocol itself is based on a comparison of the public and private key pair – only If they match, the connection is established. Those keys are generated for each device separately. What does it mean? Hypothetically, even if someone knows your password and takes control of your phone and 2FA codes, the computer will not know your private key and won’t be able to access repos.
GitHub as a backup? No!
GitHub does its best to protect your repositories hosted within its platform. But treating it as a backup itself is a huge abuse and misunderstanding. Reliable backup software should provide you with automation, central management, versioning, long-term retention, encryption, and flexible recovery. Moreover, GitHub is your production environment and once you work on it, it can not call it a backup. A proven GitHub backup software, like GitProtect.io, ensures you with your data accessibility and recoverability even if GitHub is down or your developers made some serious mistake and wiped out repositories irreversibly. With such software, you can avoid downtime, restore your data in minutes and get back to coding immediately.
