Code repository security: Git, signed commits and access
You learn to check who can change a repository, whether a change really came from its author and what has leaked into its history.
Level 101 · 17 lessons · 15 practice labs
Lessons
Git through a security lens
- Git objects and history: nothing is truly deleted
- Author and committer: why identity is easy to fake
- .gitignore and files added by mistake
- Reviewing history: git log, git show and the pickaxe search
- Short task: find a deleted password in a repository’s history
Signed changes
- Why signing commits matters
- Signing commits and tags with an SSH key
- Signing with GPG and verifying the signature
- The allowed signers file and signature checks
- Short task: find the unsigned release tags in a repository
Access and branch protection
- Repository access levels: read, write, admin
- Branch protection: blocking direct pushes, requiring review
- Required reviewers with CODEOWNERS
- Deploy keys and access tokens
- Access reviews: leavers and forgotten keys
- Short task: protect the main branch and assign owners to the security folder
Capstone
- Capstone: audit and secure an inherited repository
Practice labs
- Find a deleted password in a repository’s history: Use git log and the pickaxe search to find the commits where the password was added and removed.
- Block mistakenly added files with .gitignore: Untrack an environment file and a key file that got into the repository, write the .gitignore rules and show new additions are blocked.
- Expose a commit with a faked author identity: Prove a commit was made under someone else’s name by comparing author and committer fields, signature status and the server’s push record.
- Sign a commit with an SSH key: Configure Git to sign with SSH, sign a commit and display the signature information.
- Verify signatures with the allowed signers file: Add team members’ public keys to the allowed signers file and list whose signatures in the history verify.
- Find the unsigned release tags and set up signed releases: Scan the repository’s tags by signature status, report the unsigned ones, create a new GPG-signed tag and document the verification step.
- Block direct pushes to the main branch: Turn on protection for the main branch on the Git server and show a direct push is rejected.
- Assign owners to the security folder with CODEOWNERS: Write a CODEOWNERS file and verify a request changing the security folder cannot merge without owner approval.
- Find and close the way around branch protection: Show protection can be bypassed through an admin exemption and allowed force-push, tighten the settings and test with three roles.
- List the repository’s members and access levels: Tabulate the repository’s users by read, write and admin level.
- Clean up a forgotten deploy key and token: Find an old deploy key with write access and a non-expiring access token, remove them and issue read-only, expiring replacements.
- Close leavers’ access across all repositories: Use the Git server’s API to scan memberships, keys and tokens across all repositories, remove those of two leavers and produce a report.
- Assess an inherited repository with a checklist: Fill in a ten-item checklist on branch protection, signing, secrets and access by examining the repository.
- Prioritise the findings in an inherited repository: Rank the key in history, the unsigned tags and the over-privileged members by risk and write a fix step for each.
- Secure an inherited repository end to end: In a repository inherited from Kuzeyyıldızı Kargo, void the secret, protect the branch, assign owners, narrow access and evidence the before and after.
About this course
You learn to check who can change a repository, whether a change really came from its author and what has leaked into its history.
What you will learn
- Git through a security lens
- Signed changes
- Access and branch protection
- Capstone
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.