3 ms·
GitHub is just a host of the repo, the owner has ultimate responsibility to insure they are not uploading their private keys, as other Git code repo hosts and s
by techjuice 11y ago
GitHub is just a host of the repo, the owner has ultimate responsibility to insure they are not uploading their private keys, as other Git code repo hosts and software providers would also need to accommodate the enhanced security requirements. If they took on this task then they would also need to insure people are not uploading other private information (e.g. database passwords, API keys, etc.). Yes, it may be better for the entire Github community in the long run but becoming a source code security company may not be something that GitHub wants to get into at this point.
It would be nice if there were pre-checks client side on git status, diffs, branches, checkout, merges, init, add and commit that could quickly be checked to warn the user about the potential issue. Something like this would be a nice addition for helping user's audit their code for vulnerabilities that they may not have known about. Though this would turn Git into a security product too.
Creating the extensions required for this might be a little complicated for the average user but if something were created, secured, reviewed and regularly updated this might be something that can be matured into easy to use git extensions or something officially supported by Git or GitHub.