Practical checks for small GitHub projects.
This is a short guide for keeping public repos easier to trust and safer to maintain.
- Add a license.
- Add
SECURITY.md. - Turn on Dependabot where it makes sense.
- Keep workflow permissions as small as possible.
- Protect important branches.
- Avoid committing secrets.
- Keep setup docs clear enough for someone else to run the project.
A public repo should say how people can use the code.
Common choices:
- MIT for permissive projects
- Apache-2.0 for permissive projects with patent language
- GPL family for copyleft projects
No license usually means people should not assume they can reuse the code.
Add SECURITY.md if the repo is public or expects users.
Keep it short:
# Security Policy
If you find a security issue, do not open a public issue with exploit details.
Send:
- affected file or behavior
- reproduction steps
- expected impact
- suggested fix, if you have oneDependabot can open update PRs for supported ecosystems.
Example for GitHub Actions:
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"Prefer explicit read-only defaults:
permissions:
contents: readOnly add write permissions when a job needs them.
Check carefully before using:
permissions: write-allFor important repos, protect the default branch.
Useful rules:
- require pull requests before merging
- require status checks
- block force pushes
- block branch deletion
Small solo repos may not need all of this on day one, but public tools should move toward it.
Do not commit:
- API keys
- tokens
.env- private keys
- production config files
Add common local files to .gitignore.
If a secret gets committed:
- revoke it
- rotate it
- remove it from history if needed
Do not just delete the line and keep using the same secret.
Related tool:
github-security-checkup: https://github.com/FxckingAngel/github-security-checkup