Six free GitHub security settings

Posted by GitHub (@github)

Maintainers: You don’t need to be a security engineer to improve your project’s security.

Enable these 6 free GitHub settings in under 30 minutes.

1. Add a SECURITY.md file

Tell researchers how to report vulnerabilities privately, what’s in scope, and what information to include.

Without clear guidance, a well-meaning reporter may resort to a public issue or struggle to reach you at all.

2. Enable private vulnerability reporting

Give researchers a confidential place to report vulnerabilities directly in your repository.

You can triage the report privately, collaborate on a fix, and disclose it on your timeline.

3. Turn on secret scanning with push protection

Millions of secrets are exposed in public repositories every year.

Secret scanning detects leaked credentials. Push protection helps stop API keys and tokens before they enter your repository.

4. Enable Dependabot and dependency review

Your project includes code from every package it depends on.

Dependabot alerts you to known vulnerabilities. Dependency review shows what a pull request adds or upgrades and whether those changes introduce vulnerable dependencies.

5. Turn on code scanning

Code scanning uses CodeQL to identify patterns that lead to vulnerabilities, including injection flaws, unsafe deserialization, and insecure GitHub Actions workflows.

Default setup chooses the appropriate queries and runs them on pull requests.

6. Protect your default branch

Require pull requests and at least one approval before merging.

This reduces the risk of compromised credentials or accidental direct pushes. It also helps ensure security findings are addressed before code is merged.

These settings won’t make your project unhackable. Nothing will.

But they make your project significantly harder to attack, protecting its users and everything that depends on it.