Secure Git Practices: Protecting Your Codebase from Accidental or Malicious Changes

By /

Listen to this Post

A single `git push –force` can undo months of work. Protect your branches before you regret it.

👉 Secure Git Access

  • Enforce SSH keys or personal access tokens (disable password authentication).
  • Use branch protection rules (e.g., no direct pushes to main).
  • Require signed commits to prevent identity spoofing.

You Should Know:

  • Generate an SSH key for Git: 
    ssh-keygen -t ed25519 -C "[email protected]" 
eval "$(ssh-agent -s)" 
ssh-add ~/.ssh/id_ed25519
  • Enable branch protection in GitHub: 
    Via GitHub API (example) 
curl -X PUT -H "Authorization: token YOUR_TOKEN" \ 
-d '{"required_status_checks": {"strict": true}, "enforce_admins": true, "required_pull_request_reviews": {"required_approving_review_count": 1}, "restrictions": null}' \ 
"https://api.github.com/repos/OWNER/REPO/branches/main/protection"

👉 Protect CI/CD Pipelines

  • Store secrets securely (e.g., GitHub Actions Secrets, AWS Secrets Manager).
  • Implement least privilege access for CI/CD services.
  • Enable audit logs to track pipeline actions.

You Should Know:

  • GitHub Actions Secrets: 
    Set a secret via CLI (gh CLI required) 
gh secret set AWS_ACCESS_KEY_ID --body="YOUR_KEY"
  • AWS Secrets Manager CLI: 
    aws secretsmanager create-secret --name "prod/git-token" --secret-string "YOUR_SECRET"

👉 Manage Repository Permissions

  • Follow the principle of least privilege (e.g., no unnecessary write access).
  • Regularly review and revoke stale user access.
  • Use code review workflows (require pull requests and approvals).

You Should Know:

  • Audit GitHub repository access: 
    gh api repos/OWNER/REPO/collaborators --jq '.[].login'
  • Revoke a collaborator’s access: 
    gh api -X DELETE repos/OWNER/REPO/collaborators/USERNAME

👉 Prevent Code Tampering

  • Enable code signing for deployments.
  • Use dependency scanning to detect vulnerabilities in libraries.
  • Automate static analysis to catch security issues early.

You Should Know:

  • Sign Git commits: 
    git config --global commit.gpgsign true 
git commit -S -m "Your signed commit"
  • Scan dependencies with npm audit: 
    npm audit

👉 Monitor & Audit Activity

  • Enable audit logging in GitHub, GitLab, or Bitbucket.
  • Set up alerts for suspicious activity (e.g., force-push to protected branches).
  • Regularly review access logs and code changes.

You Should Know:

  • Check Git history for force pushes: 
    git reflog show --date=iso
  • GitHub audit log query: 
    gh api orgs/ORG/audit-log --paginate --jq '.entries[] | select(.action == "repo.force_push")'

What Undercode Say

Git security is critical in modern DevOps workflows. A single misconfigured permission or unchecked `–force` push can lead to catastrophic data loss. Always:
– Use `–force-with-lease` instead of `–force` to prevent overwriting others’ work.
– Automate security checks with tools like `pre-commit` hooks: 

 Sample pre-commit hook to block force pushes 
if [[ $(git log -1 --pretty=format:%s) == "--force" ]]; then 
echo "Force push detected! Aborting." 
exit 1 
fi

– Leverage Git’s built-in protections: 

git config --global receive.denyNonFastForwards true

– Monitor real-time changes with `inotifywait` (Linux): 

inotifywait -m -r .git/refs/heads/

Expected Output:

A secure Git workflow with enforced branch protection, signed commits, and automated audits.

Relevant URLs:

References:

Reported By: Https: – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 TelegramFeatured Image

Related Posts: