{"id":97204,"date":"2026-07-01T08:59:29","date_gmt":"2026-07-01T15:59:29","guid":{"rendered":"https:\/\/github.blog\/?p=97204"},"modified":"2026-07-28T06:44:07","modified_gmt":"2026-07-28T13:44:07","slug":"6-security-settings-every-github-maintainer-should-enable-this-week","status":"publish","type":"post","link":"https:\/\/github.blog\/security\/6-security-settings-every-github-maintainer-should-enable-this-week\/","title":{"rendered":"6 security settings every GitHub maintainer should enable this week"},"content":{"rendered":"\n

At GitHub Security Lab, we spend a lot of our week talking to maintainers. Some find the settings page dense and the docs sprawl. Most maintainers we talk to weren’t hired to be security engineers. While this is true, ignoring a project’s security settings completely will lead into leaving a lot in the table in terms of automation and scalability, leading into a poor security posture, and before you realize it to vulnerabilities that pile up, exposing your users.<\/p>\n\n\n\n

Here’s the short version. Six settings, free to use, updated in less than half an hour. We’ve bundled them into a guided flow called Protect Your Project<\/a> so you can do them in one pass, and we walk through each tool you’ll use below.<\/p>\n\n\n\n

1. Add a SECURITY.md file<\/h2>\n\n\n\n

This is the lightest-lift setting on the list and the one that makes everything else easier.<\/p>\n\n\n\n

A SECURITY.md<\/code> file tells the people who find bugs in your project where to send them. Without one, your options for a well-meaning reporter are a public issue (now a public exploit) or your personal email (if they can find it).<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

You don’t need to write much. We suggest adding a communication means such as an email so that those reporting vulnerabilities can reach you directly without posting about them publicly. Then, you can state what bugs are in scope, alongside anything else a reporter should have in mind when contacting you. For reference, we point maintainers to the the systemd project’s security policy<\/a> that we consider a complete example. It sets clear expectations about reproducers and doesn’t assume you have a 24\/7 response team when you don’t. Borrow the structure, change the contact details, commit it.<\/p>\n\n\n\n

Ten minutes, tops.<\/p>\n\n\n\n

2. Turn on private vulnerability reporting<\/h2>\n\n\n\n

SECURITY.md<\/code> tells reporters where to go. Private vulnerability reporting (PVR) gives them a private place to make their report.<\/p>\n\n\n\n

Once enabled, a researcher can file a confidential advisory on your repo. You triage it out of the public eye and disclose on your timeline. The setup is one checkbox in Settings → Security.<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

If you only do one thing tonight, do these first two together. They are free, and are the fastest signal to your community that you take this seriously.<\/p>\n\n\n\n

3. Turn on secret scanning, with push protection<\/h2>\n\n\n\n

This is the one with the most embarrassing failure mode.<\/p>\n\n\n\n

GitGuardian’s State of Secrets Sprawl 2026<\/a> found 28.65 million new secrets leaked on public GitHub in 2025, a 34% jump over the prior year and the largest single-year increase on record. AI-assisted commits are leaking secrets at roughly twice the baseline rate. The average cost of a data breach now sits at $4.44 million globally ($10.22 million in the US) per IBM’s 2025 Cost of a Data Breach Report<\/a>.<\/p>\n\n\n\n

Secret scanning catches keys and tokens that slip into your repo by blocking them locally before they’re pushed to your repository. It doesn’t matter if your repo is public or private, because once secrets leave your local development, then they are available to anyone with access to your repo.<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

4. Turn on Dependabot and dependency review<\/h2>\n\n\n\n

Your project isn’t just your code. It’s the dozens (often hundreds) of packages your code pulls in.<\/p>\n\n\n\n

Looking at WordPress, for example: this search for reviewed, critical-severity advisories mentioning WordPress<\/a> returns a long list of plugins with known vulnerabilities. If you’re running a WordPress site, Dependabot helps ensure none of these plugins are sitting in your dependencies.<\/p>\n\n\n\n

Dependabot alerts you when a package you depend on has a known vulnerability. Dependency review shows you, inside a pull request, exactly what’s being added or upgraded and whether any of it has an open advisory. Together they turn an opaque package.json<\/code> diff into a two-minute review.<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

5. Turn on code scanning<\/h2>\n\n\n\n

Code scanning runs static analysis on your repo and flags the patterns that lead to real bugs. SQL injection. Command injection. Dangerous deserialization. The usual cast.<\/p>\n\n\n\n

Code scanning with CodeQL can detect unsafe GitHub Actions workflows. CodeQL is the engine, and we built code scanning. We made it free for open source in 2019, and it now ships as a one-click default setup in your Security and Quality tab.<\/p>\n\n\n\n

This is the setting most maintainers skip because it sounds like it needs configuration. It doesn’t. Default setup picks the right query pack for your language and runs on every pull request.<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

6. Turn on branch protection on your default branch<\/h2>\n\n\n\n

This is the simplest, least-flashy setting, but it will yield the biggest impact starting as soon as you turn it on. This is about requiring a pull request before merging to main<\/code> with minimum one approval.<\/p>\n\n\n\n