Lightning Talk: Securing Your Source Repositories - 5 Tips to Get Started!
summary
Enable account two-factor authentication (Google Authenticator or U2F keys) and expect platforms to enforce it; require protected branches with two-person review and CI checks so compromised accounts cannot push changes alone; run automated dependency updates with Dependabot or Renovate to reduce lingering CVEs; start signing commits (GPG/SSH or sigstore/git-sign) and use scoped, ephemeral OIDC tokens for CI so leaked credentials have minimal impact.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:55Enable 2FA
- 1:17Protected Branches
- 2:11Automate your dependency updates
- 2:31Sign your commits
- 3:58OSSF Scorecards
related talks
17mNo More Walled Gardens: Removing Barriers with SCM...
49mProtect Your Code with GitHub Security Features
38mFortifying Your Codebase with GitHub
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
05mLightning Talk: 5 Tactics To Forging a Hardened Software Chain
49mEnhancing CI/CD Secrets Security: The 3Rs Approach
30mSecuring Open Source Supply Chains
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel