Security Best Practices

~11 min · security, checklist, hardening

Level 0Apprentice

0 XP0/101 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

The checklist

The whole secrets/permissions track condenses to a checklist worth running on every repo. Most teams pass 5 of the 10 on first audit.

Org default for GITHUB_TOKEN is restricted (read-all). Set in Org Settings → Actions → Workflow permissions.
Every workflow has explicit permissions: at the top level, defaulting to read.
Third-party actions are SHA-pinned — never floating tags for actions you don't own.
Cloud auth uses OIDC — no long-lived keys for AWS / GCP / Azure.
Production environment has required reviewers + branch policy.
Secret scanning + push protection enabled on the repo.
No pull_request_target + checkout of PR head SHA anywhere.
Dependabot version updates enabled with automerge for security patches.
CodeQL workflow exists and runs weekly.
Secret rotation procedure documented — when (quarterly), how (provider rotate + repo update), and tested at least once.

Code

Self-audit one-liner — what permissions does each workflow declare?·bash

for f in .github/workflows/*.yml; do
  echo "== $f =="
  awk '/^permissions:/,/^[a-z]/ { print }' "$f" | head -10
  echo
done
# Workflows missing top-level permissions: block? They default to whatever
# the org permits. Add explicit permissions:read-all and re-run.

External links

GitHub — Security hardening for GitHub Actions

Exercise

Pick one repo. Walk the 10-item checklist above. For each failed item, file an issue (don't fix yet) and tag it security-hardening. Now you have your roadmap.