Is GitHub Safe? [Helpful Tips You Need To Know]

Over 100 million developers use GitHub as a platform to create software. It is a cloud-based platform where web developers store, manage, control, and track code. 

However, users wonder if GitHub is safe. Despite its efficacy, it remains vulnerable to issues like malware attacks and online threats.

Continue reading to know if GitHub is safe.

How Safe is GitHub?

Millions of web developers worldwide have enjoyed GitHub's features. It has an AI tool called GitHub Co-pilot, which uses human language prompts to generate codes.

Another standout feature is GitHub Pages. This feature allows developers to host a static website from a repository. 

With these features and more, users are guaranteed that GitHub is very secure. You will need to generate SSH keys to access the platform. 

However, various events and instances still tested the platform's integrity. Find out what those events are in the next section. 

GitHub Attacks

Around 30,000 websites experience hacking each day. Like any other site, GitHub has been a target of cyberattacks. 

Here are some of the known GitHub attacks that startled its users worldwide:

The 2015 GitHub attack

The worst DDoS attack ever recorded also hit GitHub in March 2015. The users behind the attack designed it to last six days and to use DDoS mitigation strategies. 

GitHub Status gave continuous updates regarding the attack on Twitter: 

The attack came from China, targeting two projects linked to bypassing Chinese Censorship. Speculations show that the attack wanted to pressure GitHub into deleting those projects.

Users behind the attack injected JavaScript code into every Baidu visitor's browser. Other sites that used Baidu's analytics also caught the malicious code. 

The infected browsers and sites sent HTTP requests to a targeted GitHub page. 

After the attack, someone discovered that the malicious code was not from Baidu but from an intermediary service.

2018 GitHub DDoS Attack

Another massive DDoS attack in history targeted GitHub. This attack reached 1.3 terabytes per second, sending 126.9 million packets every second.

The 2018 GitHub attack was a Memcached DDoS attack with no botnets involved. The attackers leveraged the amplification effect of the popular database caching system.

This attack flooded Memcached servers with spoofed requests, which helped the attackers intensify the raid nearly 50,000 times.

Fortunately, GitHub was using a DDoS protection service. The platform got an alert within 10 minutes of the start of the attack.

This alert triggered the mitigation, and GitHub was able to stop the attack soon. The entire attack only lasted for about 20 minutes.

2022 GitHubAttack

On April 12, 2022, GitHub discovered a breach when the attacker accessed the Node Package Manager (NPM). The platform revealed the breach three days afterward.

Along with Heroku and Travis CI, GitHub canceled all OAuth tokens. 

This step blocked access while notifying affected organizations to check for suspicious activity. GitHub said it came from an unknown assailant who got data from private code storages.

Affected Heroku or Travis CI OAuth apps were given access to different GitHub accounts, allowing the attacker to document organizations before setting targets.

The attacker even listed and cloned the private repository for user accounts.

GitHub Attack on March 2023

According to a March 2023 report, GitHub got hacked—-exposing its RSA SSH host key in a public repository. 

The incident raised issues within the developer community about their code security. It forced GitHub to take speedy actions to deter any further damage. 

After the leak, GitHub replaced its RSA SSH host key. This stopped the impersonation of the service or eavesdropping on operations over SSH.

GitHub confirmed no evidence of any adversaries exploiting the exposed SSH private key. However, the leaked key has caused much concern among platform developers.

Effects of Compromised GitHub

With so many users, a compromised GitHub can leave a significant impact on users. Here are some of the things that may happen once your GitHub account is compromised:

Harm to Programs

A compromised account can allow hackers to distribute malware disguised as legitimate software. This can deceive users into downloading malware and viruses—harming the user’s programs, devices, or systems.

Data Breach and Identity Theft

Once hackers enter GitHub, they can access all data—even confidential ones. When someone attacks GitHub, it can result in data theft, financial loss, and company damage.

Lowers Trustworthiness

If GitHub is compromised multiple times, it can lead users to steer clear of the platform. 

As a critical tool for developers, any incident can decrease the GitHub trust level. The platform’s market integrity will also go down.

How to Make Your GitHub Account Safer?

Since risks are always around, it's best to know how to mitigate them before they happen. Here are some ways you may do to reduce the threats on GitHub:

1. Create a Strong Password

80% of hacking incidents worldwide are due to password-related issues. This is why using a strong password for your GitHub account is necessary.  

There are multiple ways to have a strong password. You can generate a password for your account that is either:

• 8 characters long, including a number and a lowercase letter
• 15 characters long, with a combination of symbols

Other than generating a strong password, it is also crucial that you keep it safe. Here are some password best practices you should follow: 

• Use a unique password for GitHub. Having the same password for all your accounts makes it easy for hackers to access everything.
• Do not share your password—even with a possible collaborator. 
• For additional safety, use a trusted password manager. 

2. Update Your Access Credentials

GitHub credentials include passwords, access tokens, SSH keys, and API tokens. It is crucial to secure these details all the time.

One way to keep your credentials safe is by updating them regularly. 

For instance, if you’re using a weak password, it is best to update it to a new one. This also applies if you forgot it or it was leaked. 

Here’s how to update your GitHub password:

Step 1: Go to GitHub Password Reset Page. 

Step 2: Enter the email address linked to your GitHub account. 

Step 3: GitHub will send an email with a link to reset your  password. Click the link. 

Step 4: You will receive a code depending on whether you use your account’s 2FA or GitHub mobile. 

Step 5: Click Enter two-factor authentication code or Use recovery code to verify.

Step 6: Enter the code and click Verify.

Step 7: Type a new password in the text field and confirm. 

Step 8: Click Change password and save.

3. Review Your Security Log

Always check your account’s security log to monitor every action taken. It will also let you see any suspicious activity involving your account.

Your security log lists all actions done within the last 90 days. To check it, here’s how: 

1. Click your profile photo. 
2. Select Settings in the upper-right corner of any page.
3. Click Security Log in the Archives section of the sidebar. It should show something like:

Each log entry shows the object or category qualifier, followed by an operation type. For example, the repo.create entry refers to the complete operation on the repo category.

Any log entry shows applicable information about an event, such as:

4. Prevent Unauthorized Access

GitHub was designed to send an alert when a security incident happens. 

You will receive an alert for instances like during a Heartbleed bug discovery or when a device with a GitHub account is stolen. 

GitHub asks for a password to perform sensitive actions in situations like this. These actions can be:

• Authorizing applications
• Adding new SSH keys
• Modifying team members

Take note of the following best practices to keep your account secured at all times: 

Conclusion

GitHub is generally safe. However, it can be more secure since its features can improve a repository's security. The only challenge is to keep programs safe if you set up public storage. 

Always consider using private repositories since they are more secure. To avoid a security breach, follow the steps above to ensure no one else can access your projects and programs.