TL;DR
Your GitHub repository is a security boundary. Turn on secret scanning and Dependabot, review .gitignore for anything sensitive, protect your default branch, and audit who still has access. The 15 items below are split by urgency: 5 critical to fix before launch, 6 important within the first week, and 4 recommended for when you get to them.
Most repo breaches come down to something embarrassingly simple: a leaked API key in a commit from six months ago, or a .env file that slipped past .gitignore. GitHub's built-in tools catch most of that for free, and they're off by default. Spend 30 minutes on this list and you'll close the gaps attackers actually go looking for.
Quick Checklist (5 Critical Items)
Secret Protection 4
Dependency Security 4
Access Control 4
GitHub Actions Security 3
Before Making a Repo Public
Before you flip a private repository to public, run this entire checklist twice. Once a secret is in public git history, treat it as compromised, and deleting it afterwards doesn't undo that: bots scrape the public firehose continuously, and a credential can be picked up seconds after it appears.
Use tools like git-secrets or truffleHog to scan your entire git history for secrets before making a repo public.
I accidentally committed a secret. What do I do?
First, rotate the secret immediately. The credential is compromised regardless of what you do with git history. Then, use git filter-branch or BFG Repo-Cleaner to remove it from history. Finally, force push and have all collaborators re-clone.
Is a private repo enough to protect secrets?
No. Private repos get flipped public by accident, team members come and go, and backups often live somewhere less protected than the repo itself. Use environment variables and a secrets manager even when the repo is private. Treat .gitignore and secret scanning as required, not optional.
How do I share secrets with my team?
Use GitHub Secrets for CI/CD, a secrets manager (1Password, Doppler) for team access, and environment variables for local development. Never commit secrets to the repository, even in private repos.
Scan Your Repository
Check for exposed secrets and security misconfigurations in your codebase.