Is GitHub Safe? [Helpful Tips You Need To Know]

Over 100 million developers use GitHub as a platform to create software. It is a cloud-based platform where web developers store, manage, control, and track code. 

However, users wonder if GitHub is safe. Despite its efficacy, it remains vulnerable to issues like malware attacks and online threats.

Continue reading to know if GitHub is safe.

🔑 Key Takeaways

• GitHub is a cloud-based platform for code storage and management, offering features like AI-generated code suggestions and website hosting.
• The platform faced cyberattacks, DDoS incidents, and breaches—raising concerns about its integrity.
• Notable GitHub attacks happened in 2015, 2018, 2022, and 2023.
• Users can improve security by using strong passwords, enabling 2FA, updating credentials, and monitoring security logs.
• Compromised accounts could lead to malware distribution, data breaches, identity theft, financial loss, and reputation damage. Prioritizing security measures is essential.

How Safe is GitHub?

Millions of web developers worldwide have enjoyed GitHub’s features. It has an AI tool called GitHub Co-pilot, which uses human language prompts to generate codes.

Another standout feature is GitHub Pages. This feature allows developers to host a static website from a repository. 

With these features and more, users are guaranteed that GitHub is very secure. You will need to generate SSH keys to access the platform. 

However, various events and instances still tested the platform’s integrity. Find out what those events are in the next section. 

GitHub Attacks

Around 30,000 websites experience hacking each day. Like any other site, GitHub has been a target of cyberattacks. 

Here are some of the known GitHub attacks that startled its users worldwide:

1. The 2015 GitHub attack

The worst DDoS attack ever recorded also hit GitHub in March 2015. The users behind the attack designed it to last six days and to use DDoS mitigation strategies. 

GitHub Status gave continuous updates regarding the attack on Twitter: 

We continue to respond to an ongoing DDoS attack. Some users may experience inter… See more at https://t.co/Z4QAKh0oGe.

— GitHub Status (@githubstatus) March 27, 2015

The attack came from China, targeting two projects linked to bypassing Chinese Censorship. Speculations show that the attack wanted to pressure GitHub into deleting those projects.

Users behind the attack injected JavaScript code into every Baidu visitor’s browser. Other sites that used Baidu’s analytics also caught the malicious code. 

The infected browsers and sites sent HTTP requests to a targeted GitHub page. 

After the attack, someone discovered that the malicious code was not from Baidu but from an intermediary service.

2. 2018 GitHub DDoS Attack

Another massive DDoS attack in history targeted GitHub. This attack reached 1.3 terabytes per second, sending 126.9 million packets every second.

The 2018 GitHub attack was a Memcached DDoS attack with no botnets involved. The attackers leveraged the amplification effect of the popular database caching system.

This attack flooded Memcached servers with spoofed requests, which helped the attackers intensify the raid nearly 50,000 times.

Fortunately, GitHub was using a DDoS protection service. The platform got an alert within 10 minutes of the start of the attack.

This alert triggered the mitigation, and GitHub was able to stop the attack soon. The entire attack only lasted for about 20 minutes.

3. 2022 GitHubAttack

On April 12, 2022, GitHub discovered a breach when the attacker accessed the Node Package Manager (NPM). The platform revealed the breach three days afterward.

Along with Heroku and Travis CI, GitHub canceled all OAuth tokens. 

GitHub has uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Read more about the impact to GitHub, npm, and our users. https://t.co/eB7IJfJfh1

— GitHub Security (@GitHubSecurity) April 15, 2022

This step blocked access while notifying affected organizations to check for suspicious activity. GitHub said it came from an unknown assailant who got data from private code storages.

Affected Heroku or Travis CI OAuth apps were given access to different GitHub accounts, allowing the attacker to document organizations before setting targets.

The attacker even listed and cloned the private repository for user accounts.

4. GitHub Attack on March 2023

According to a March 2023 report, GitHub got hacked—-exposing its RSA SSH host key in a public repository. 

The incident raised issues within the developer community about their code security. It forced GitHub to take speedy actions to deter any further damage. 

After the leak, GitHub replaced its RSA SSH host key. This stopped the impersonation of the service or eavesdropping on operations over SSH.

GitHub confirmed no evidence of any adversaries exploiting the exposed SSH private key. However, the leaked key has caused much concern among platform developers.

Effects of Compromised GitHub

With so many users, a compromised GitHub can leave a significant impact on users. Here are some of the things that may happen once your GitHub account is compromised:

1. Harm to Programs

A compromised account can allow hackers to distribute malware disguised as legitimate software. This can deceive users into downloading malware and viruses—harming the user’s programs, devices, or systems.

2. Data Breach and Identity Theft

Once hackers enter GitHub, they can access all data—even confidential ones. When someone attacks GitHub, it can result in data theft, financial loss, and company damage.

3. Lowers Trustworthiness

If GitHub is compromised multiple times, it can lead users to steer clear of the platform. 

As a critical tool for developers, any incident can decrease the GitHub trust level. The platform’s market integrity will also go down.

How to Make Your GitHub Account Safer?

Since risks are always around, it’s best to know how to mitigate them before they happen. Here are some ways you may do to reduce the threats on GitHub:

1. Create a Strong Password

80% of hacking incidents worldwide are due to password-related issues. This is why using a strong password for your GitHub account is necessary.  

There are multiple ways to have a strong password. You can generate a password for your account that is either:

• 8 characters long, including a number and a lowercase letter
• 15 characters long, with a combination of symbols

Other than generating a strong password, it is also crucial that you keep it safe. Here are some password best practices you should follow: 

• Use a unique password for GitHub. Having the same password for all your accounts makes it easy for hackers to access everything.
• Do not share your password—even with a possible collaborator. 
• For additional safety, use a trusted password manager. 

2. Update Your Access Credentials

GitHub credentials include passwords, access tokens, SSH keys, and API tokens. It is crucial to secure these details all the time.

One way to keep your credentials safe is by updating them regularly. 

For instance, if you’re using a weak password, it is best to update it to a new one. This also applies if you forgot it or it was leaked. 

Here’s how to update your GitHub password:

Step 1: Go to GitHub Password Reset Page. 

Step 2: Enter the email address linked to your GitHub account. 

Step 3: GitHub will send an email with a link to reset your  password. Click the link. 

Step 4: You will receive a code depending on whether you use your account’s 2FA or GitHub mobile. 

Step 5: Click Enter two-factor authentication code or Use recovery code to verify.

Step 6: Enter the code and click Verify.

Step 7: Type a new password in the text field and confirm. 

Step 8: Click Change password and save.

3. Review Your Security Log

Always check your account’s security log to monitor every action taken. It will also let you see any suspicious activity involving your account.

Your security log lists all actions done within the last 90 days. To check it, here’s how: 

1. Click your profile photo. 
2. Select Settings in the upper-right corner of any page.
3. Click Security Log in the Archives section of the sidebar. It should show something like:

Each log entry shows the object or category qualifier, followed by an operation type. For example, the repo.create entry refers to the complete operation on the repo category.

Any log entry shows applicable information about an event, such as:

4. Prevent Unauthorized Access

GitHub was designed to send an alert when a security incident happens. 

You will receive an alert for instances like during a Heartbleed bug discovery or when a device with a GitHub account is stolen. 

GitHub asks for a password to perform sensitive actions in situations like this. These actions can be:

• Authorizing applications
• Adding new SSH keys
• Modifying team members

Take note of the following best practices to keep your account secured at all times: 

	Enable two-factor authentication for your GitHub account. 2FA offers 100% protection against automated attacks.
	Check your SSH keys, deploy keys, and authorized integrations.
	Cancel unauthorized or unfamiliar access in your SSH and Applications settings.
	Monitor all your email addresses. If an attacker adds their email to your account, it could force them to reset an unintended password.
	Re-visit your GitHub account’s security log. Ensure that no repositories are made public or transferred.
	Review the webhooks on your repositories. These could allow an attacker to intercept pushes made to your storage.
	Make sure that there are no new deploy keys. This could enable external server entry to your projects.
	Review previous commits made to your repositories.
	Review the list of collaborators per repository.

Conclusion

GitHub is generally safe. However, it can be more secure since its features can improve a repository’s security. The only challenge is to keep programs safe if you set up public storage. 

Always consider using private repositories since they are more secure. To avoid a security breach, follow the steps above to ensure no one else can access your projects and programs.

FAQs

By Aditya Rayaprolu

Aditya is an Azure DevOps and Infrastructure Virtualization Architect with experience in automation, infrastructure management, and designing and implementing virtualization solutions. His expertise encompasses both on-premise and cloud-based systems. Aditya's articles on TechJury serve as a reliable resource for individuals and organizations looking to harness the power of cloud computing, embrace automation, and leverage infrastructure-as-code practices.