Repository Security
📌 Covered in this chapter:
Secret Scanning · Dependabot · Branch Protection · Signed Commits
Protect your codebase from leaked secrets and vulnerable dependencies using GitHub's built-in security tooling.
1Repository Security — What You'll Learn
Protect your codebase from leaked secrets and vulnerable dependencies using GitHub's built-in security tooling.
Here's everything this chapter covers, in the order you'll learn it:
- Never committing passwords directly
- Never committing API keys directly
- Keeping secrets in .env files (and .gitignore-ing them)
- GitHub's automatic secret scanning
- Dependabot for automatic dependency update PRs
- Reviewing security advisories
- Setting up branch protection rules
- Requiring reviews before merge
- Requiring passing status checks before merge
- Signed commits for verified authorship
- Keeping SSH keys safe
- Managing personal access tokens
2Best Practices & Common Pitfalls
💡 Key things to remember:
- If you accidentally commit a secret, simply deleting it in a new commit is NOT enough — it still exists in history. You must rotate/revoke the exposed credential immediately, then rewrite history if needed.
❓ Frequently Asked Questions (FAQ)
Q What's the most important thing to understand about repository security?
Focus on: Secret Scanning · Dependabot · Branch Protection · Signed Commits. These are the core building blocks this chapter's examples are built around, and they show up repeatedly in later chapters of this course.
Q Is repository security something I'll use often in real projects?
Yes — every concept in this chapter reflects a real, everyday part of professional Git and GitHub workflows, not just a theoretical exercise.