4 ms·
Think carefully about the consequences of this automated scan info leaking before enabling it in your private repositories.
by thesmallestcat 9y ago
Think carefully about the consequences of this automated scan info leaking before enabling it in your private repositories.
- fanon 9y agoAre the consequences significantly different than having private repos on Github to begin with? I realize this is one more Github service with access to metadata about your code, so the attack surface is technically larger, but is the probability of leak that much greater from this service than it already is by having your code on their servers (which, I assume, are protected by the same security team)? Maybe it's an oversimplification but my expectation is that any project with such sensitivity wouldn't be hosted on an external service at all.