GitHub Maintainers: 6 Security Settings You Should Enable This Week

If you maintain an open-source project on GitHub, you're responsible for more than just code. You're responsible for the security of your contributors and users. A recent post by Joseph (a cybersecurity educator with over 2.8M video views) highlights six security settings every maintainer should enable. Here's the rundown.

1. Enable Dependabot Alerts and Security Updates

Dependabot scans your dependencies for known vulnerabilities and automatically opens pull requests to update them. Enable it in your repository's security tab. This is the single easiest win for supply-chain security.

2. Require Two-Factor Authentication (2FA) for Contributors

GitHub allows you to enforce 2FA for all contributors to your repository. This dramatically reduces the risk of account takeover. Go to your repository settings, under "Moderation options", enable "Require 2FA".

3. Enable Secret Scanning

GitHub's secret scanning detects accidentally committed tokens, API keys, and other secrets. It runs automatically on public repositories but you should also enable push protection to block commits containing secrets.

4. Use Branch Protection Rules

Protect your default branch by requiring pull request reviews, status checks, and signed commits. This prevents direct pushes and ensures code review happens before merge. Configure this under your repository's "Branches" settings.

5. Enable Code Scanning with CodeQL

CodeQL is GitHub's semantic code analysis engine. It finds security vulnerabilities and code quality issues. Enable it in your repository's security tab — it's free for public repositories.

6. Review and Rotate Deploy Keys and Tokens

Regularly audit the SSH keys, personal access tokens, and OAuth apps with access to your repository. Remove stale or unused ones. Rotate active keys periodically.

These six settings take less than an hour to configure and can prevent the most common attack vectors against open-source projects. Don't wait for an incident.