Post

Maintainers: You don’t need to be a security engineer to improve your project’s security. 🔐 Enable these 6 free GitHub settings in under 30 minutes. 🧵

1. Add a SECURITY. md file Tell researchers how to report vulnerabilities privately, what’s in scope, and what information to include. Without clear guidance, a well-meaning reporter may resort to a public issue or struggle to reach you at all.

2. Enable private vulnerability reporting Give researchers a confidential place to report vulnerabilities directly in your repository. You can triage the report privately, collaborate on a fix, and disclose it on your timeline.

3. Turn on secret scanning with push protection Millions of secrets are exposed in public repositories every year. Secret scanning detects leaked credentials. Push protection helps stop API keys and tokens before they enter your repository.

4. Enable Dependabot and dependency review Your project includes code from every package it depends on. Dependabot alerts you to known vulnerabilities. Dependency review shows what a pull request adds or upgrades and whether those changes introduce vulnerable dependencies.

6. Protect your default branch Require pull requests and at least one approval before merging. This reduces the risk of compromised credentials or accidental direct pushes. It also helps ensure security findings are addressed before code is merged.