Security

Keep secrets and production data outside Git in the deployment platform's secret store or an ignored local file.
Give workflows top-level least-privilege permissions and pin external actions to full commit SHAs.
Do not use pull_request_target for candidate code.
Do not deploy, publish, change DNS, or mutate external systems from ordinary pull-request validation.
Review new network dependencies, embeds, analytics, and trackers for purpose, license, privacy, and failure behavior.
Keep Dependabot alerts and security updates enabled in the repository settings; .github/dependabot.yml only schedules routine version updates.
Let a new dependency version cool down before adopting it, group only minor and patch updates, and review every major update on its own.

Navigation Menu