GitAlerts: Enhancing GitHub Security and Monitoring for Organization Repositories

GitHub has become an important tool for version control and project management in the ever-changing world of software development and teamwork. GitHub is used by organizations and developers all over the world to store their repositories, work together on code, and keep track of their software projects.

But, as the saying goes, “Great power comes great responsibility.” It’s easy to control and keep an eye on GitHub repositories that are made in the name of an organization, but not so much for repositories that are made by individual users within the organization.

There are big security risks with this difference, which could cause sensitive information, secrets, and code to be revealed without purpose.

Here comes GitAlerts, a powerful tool made to fill this security hole in GitHub. GitAlerts lets organizations take control of and keep an eye on repositories that their users have made, even if those repositories are not directly under the organization’s control.

This piece will talk about the most important parts of GitAlerts, how to install it, and how it can make your GitHub repositories much safer and easier to keep an eye on. Let’s learn more about GitAlerts and how it can help keep your company’s code and secrets from getting out by accident.

What problem does it solve?

GitHub repositories created under any organization can be controlled by the GitHub administrators. However any repository created under an organization’s user account is not controllable unless the organisation has adopted the GitHub enterprise-managed user (EMU) model.

Any public repository under the organization’s user account that was created accidentally or for testing purposes could leak secrets, internal information, code etc. GitAlerts helps you detect and monitor such cases

Getting Started

• Download the binary file for your operating system / architecture from the Official GitHub Releases
• You can also install git-alerts using homebrew in MacOS and Linux

brew tap boringtools/tap
brew install boringtools/tap/git-alerts

Alternatively, build from source

go install github.com/boringtools/git-alerts@main

Setup GitHub personal access token (PAT) as the environment variable

export GITHUB_PAT=YOUR_GITHUB_PAT

Usage

Scan GitHub repositories belonging to your organization users

git-alerts scan --org your-org-name

Monitor new public repositories being created by your organization users

For more click here