Six GitHub settings to tighten your project’s security tonight
Six security switches can turn a casual repo into a guarded project in under half an hour. GitHub Security Lab’s latest guidance walks maintainers—often not hired as security engineers—through the exact levers to pull for immediate, free protection.
A one-page checklist that scales
The fastest wins start with a light lift: add a SECURITY.md file to your repository root. A single file tells friendly bug reporters where to send issues privately instead of broadcasting them publicly or hunting down your personal inbox. Keep the policy short: list contact details, outline acceptable reports, and note response expectations. The systemd project’s public template is a concise reference—copy the structure, swap the email, commit, and you’re done in about ten minutes.
From policy to private inbox
Flip the private vulnerability reporting toggle next. Once enabled, researchers can file confidential advisories directly in your repo. You triage behind the scenes and disclose on your own timeline, all with one checkbox under Settings → Security. Pairing SECURITY.md with PVR telegraphs to your community that you’re serious about fixes without adding staff.
Stop secrets before they leave your desk
Secret scanning with push protection guards the most embarrassing breach scenario. GitGuardian’s 2025 data shows nearly 29 million new secrets surfaced on public GitHub last year, a 34% jump and the highest single-year increase recorded. AI-assisted commits are leaking credentials at roughly twice the baseline rate, and the average global breach now costs $4.44 million, according to IBM’s 2025 report. Push protection blocks exposed keys or tokens at the local commit stage, before they ever reach your repository, whether public or private.
Dependencies under watch
Turn on Dependabot and dependency review. Your code doesn’t live in isolation; it relies on dozens or hundreds of packages. WordPress alone lists numerous plugins flagged for critical-severity issues. Dependabot alerts you to known vulnerabilities and can auto-raise pull requests to bump versions, while dependency review surfaces risks before a merge.
Source: GitHub Blog. AI-assisted editorial synthesis — TechnoExpress.