GitHub · hub

GitHub Security: Tools, Checklists and Labs

One leaked token or one risky workflow can let an attacker push code or publish a release in your name. These are the controls that stop it, and tools to check yours.

GitHub security best practices

Give the GITHUB_TOKEN the least it needs

GitHub Docs recommend setting the default GITHUB_TOKEN permission to read-only for repository contents and raising it only for the jobs that need more. GitHub Docs

Pin actions to a full-length commit SHA

A tag like @v4 can be moved; a full commit SHA cannot. GitHub Docs list pinning to a full-length commit SHA as a hardening step. GitHub Docs

Keep untrusted code out of privileged workflows

Workflows triggered by pull_request_target or workflow_run must not check out untrusted code, such as a pull request from a fork. Pass untrusted input like a PR title to scripts through an environment variable, not inline. GitHub Docs

Swap long-lived cloud secrets for OIDC

With OpenID Connect a workflow requests a short-lived token from your cloud provider, so cloud credentials are not stored as long-lived GitHub secrets. GitHub Docs

Prefer fine-grained personal access tokens

GitHub recommends fine-grained tokens over classic ones whenever possible: they can be limited to specific repositories and permissions, while a classic token reaches every repository you can. GitHub Docs

Protect branches and releases

Rulesets control how people can push to and merge into branches and tags. Artifact attestations give provenance that consumers can verify, showing where and how your software was built. GitHub Docs

Watch the audit log

The organization audit log shows who did what and when, so you can alert on protection overrides, new tokens, deleted runs and role changes. GitHub Docs

Tools and labs

Pro tools: a free account includes 3 Pro tool runs.

Org and access

GitHub Org Access Review(Pro)

Worksheet and scored checklist: org owners, SSO and 2FA, token and OAuth app review, SCIM deprovisioning.

GitHub vs Alternatives(Pro)

GitHub, GitLab, Bitbucket, Gitea, Forgejo and Codeberg compared on hosting model, CI, protection rules, SSO and audit logging.

CI/CD and Actions

GitHub Actions Security Auditor(Pro)

Paste a workflow YAML to flag pull_request_target risks, unpinned actions, write-all permissions, secrets in logs, curl | bash and script injection. Runs in your browser.

GitHub Branch Protection Checklist(Pro)

Score branch protection and rulesets: required reviews and checks, who can push, blocked force-push, no admin bypass, org rulesets.

Secrets and tokens

GitHub CI Secret Hardening Checklist(Pro)

Score the controls that stop a workflow leaking secrets: least-privilege GITHUB_TOKEN, OIDC, environment protection, pinned actions.

GitHub Token Scope Analyzer(Pro)

Pick a token type and scopes to see the blast radius if it leaks and the least-privilege alternative. No token is entered.

Releases and supply chain

GitHub Release Integrity Checklist(Pro)

12 controls for a trustworthy release: OIDC trusted publishing, signed releases, attestation, SLSA provenance.

GitHub Supply-Chain Attack Anatomy(Pro)

The LiteLLM GitHub-identity compromise as publicly reported, step by step, with the control that breaks each link.

Monitoring

GitHub Audit Log Monitoring(Pro)

The audit-log events worth alerting on, with action names and example detection logic, plus a coverage checklist.

Reading

GitHub Supply-Chain Attack: Anatomy and Controls

The October 2026 compromise and the controls that stop it.

OVHcloud CLI Compromise and the Release-Pipeline Gap

Why release integrity controls matter.

Questions

What are GitHub security best practices?

Keep org owners few and require SSO and two-factor authentication. Give the GITHUB_TOKEN read-only access by default and raise it per job. Pin third-party actions to a full-length commit SHA. Never check out untrusted pull request code in pull_request_target workflows. Use OIDC instead of long-lived cloud secrets and fine-grained personal access tokens instead of classic ones. Protect default branches and tags with rulesets, attest your release artifacts, and alert on audit log events such as protection overrides, new tokens and deleted workflow runs.

How do you secure GitHub Actions?

Start with permissions: set the default GITHUB_TOKEN to read-only and grant write access only to jobs that need it. Pin every action to a full commit SHA. Avoid pull_request_target unless you need it, and never check out fork code in it. Treat event data such as PR titles and branch names as untrusted and pass it to scripts through environment variables. Use OIDC for cloud access, protect deployment environments with required reviewers, and avoid self-hosted runners on public repositories.

What is the biggest GitHub Actions security risk?

Privileged workflows that run untrusted code. GitHub Docs warn that pull_request_target and workflow_run workflows that check out an untrusted pull request can expose secrets and repository write access, and can be used to take over a repository.

Should I use a personal access token or a GitHub App?

For automation, prefer a GitHub App or the workflow’s own GITHUB_TOKEN, because they are scoped to an installation or a run. If you need a personal access token, GitHub recommends a fine-grained one, limited to specific repositories and permissions, over a classic token that can reach every repository you can.

Does two-factor authentication stop a stolen GitHub token?

No. Two-factor authentication protects sign-in, but a stolen token is already authenticated and works until it expires or is revoked. That is why token scope, expiry and audit-log alerts on new tokens matter.

Sources

MCP security hub · All tools