Mapping Your Attack Surface

Supply chain attacks have broadened beyond targeting code directly. Bad actors increasingly go after user accounts, common dependencies, and build infrastructure. There is no single fix that protects an entire project, so GitHub has published a set of guides that break the work down by area: accounts, code, and builds. The guides are designed for everyone from free-plan users to enterprise administrators, and the suggested steps can be phased in over time rather than tackled all at once.

Locking Down Accounts

Account compromise is one of the highest-impact risks, whether the account belongs to an individual, an organization, or an enterprise. The documentation covers the core account hygiene measures:

  • Enabling two-factor authentication on personal accounts
  • Using SSH keys for GitHub connections
  • Centralizing authentication for enterprise users
  • Enforcing two-factor authentication across organizations and enterprises

Hardening Your Code and Dependencies

Most developer attention goes to the code itself: dependencies pulled in, tokens that leak, and vulnerabilities introduced during development. The threat model here includes vulnerable dependency trees, exposed credentials, and insecure coding patterns finding their way into a repository. The guide walks through setting up a structured response:

  • Establishing a dependency vulnerability management program
  • Protecting communication tokens from exposure
  • Blocking vulnerable coding patterns from entering repositories

Dependabot and similar tooling can automate parts of this, but the guide stresses that a repeatable process matters more than any single feature.

Securing Your Build Pipeline

Build systems are an attractive target because they let attackers compromise software without needing account access or dependency exploits. Two areas get special attention in the documentation:

  • Signing your builds to verify their integrity
  • Hardening GitHub Actions workflows against malicious use

These controls help ensure that what gets built is what you intended, and that the automation running your builds isn't a backdoor.

Getting Started

End-to-end supply chain security is broad, and treating it as a single project can be overwhelming. The guides take a more practical approach: assess where you are, pick the improvements that reduce your biggest risks first, and build from there. If you don't see a topic covered or need deeper detail, GitHub tracks feedback publicly for future updates to the documentation.