Inside GitHub: How the platform's own teams use it to ship securely
At GitHub Universe, we shared an overview of how our own engineering and security teams operate on the platform we build. The scale is significant: in the last year alone, GitHub staff made millions of commits across internal repositories, processed billions of API requests daily, and ran tens of thousands of production deployments. That translates to hundreds of deployments per day. But the underlying questions are universal, regardless of organization size: how do you optimize for productivity, collaboration, and security simultaneously?
There's an internal joke that you have to type "GitHub" three times to reach the monolith. Here's how we use GitHub (1) to build the GitHub (2) you rely on (3).
Productivity gains from cloud-based tools
Two of our biggest productivity levers have been cloud-powered experiences: Codespaces and GitHub Copilot.
Local development hasn't evolved much over the past decade, and the github/github repository, which contains much of what runs GitHub.com, is large enough that cloning took several minutes on a good network connection. Setting up dependencies and configuring an environment used to take about 45 minutes from checkout to a fully built local development environment. With Codespaces, a few clicks get you into a working environment in under 60 seconds, running on hardware that outperforms the laptops many of us use daily. We've moved our engineering team to Codespaces entirely, and the shift has measurably changed the day-to-day developer experience.
We've also been using GitHub Copilot internally for more than a year. In a recent study comparing two groups of developers—one with Copilot and one without—the Copilot group completed the same task 55% faster. The satisfaction data was equally notable: almost three-quarters of surveyed developers said Copilot helped them stay in the flow and spend more time on the enjoyable aspects of their work. It's rare for a tool to help developers do their jobs faster and enjoy them more, but that's exactly what we've found.
Structuring collaboration across distributed teams
We operate as a remote-first company with highly distributed teams, so discoverability and keeping everyone up-to-date are top priorities. Issues and projects let us plan, track, and collaborate in a centralized place directly beside the code. For our security team, incorporating projects has made it easier to track work and helps people understand how their tasks fit into the company's broader mission.
Projects provide the big-picture view, but for the tactical challenge of finding a specific file, function, or feature built by another team, we've adopted the new code search and code view. In a codebase that's been growing for 15 years, locating code written before you joined the company can feel like searching for a needle in a haystack. The improved search has helped developers find what they need without losing velocity, and that enhanced discoverability—alongside Issues and projects—has improved how teams collaborate across groups.
Security as a release enabler
The security industry faces the same struggles it has for over a decade. Exposed credentials remain the root cause of more than half of all data breaches, according to the Verizon DBIR. Phishing is still the cheapest, most effective way for adversaries to penetrate organizations. And basic protections like multi-factor authentication are still not universal. The answer is to embed security throughout the developer lifecycle rather than treating it as a final checkpoint.
Strong authentication is foundational to securing the software supply chain, and the supply chain starts with the developer. We enforce multi-factor authentication with security keys for our internal developers, and we're requiring that every developer who contributes software on GitHub.com enable 2FA by the end of next year. Bringing security and engineering teams closer together produces better outcomes and better security experiences.
We also scale the knowledge of our security teams using tools like CodeQL to create checks deployed for all developers. The vulnerability patterns our security teams—or our customers—identify become open-source CodeQL queries, available for everyone. This acts as a global force multiplier for security knowledge across the developer and security communities.
Security shouldn't gate teams from shipping. It should enable them to ship quickly and with confidence—just as we do with our hundreds of production deployments per day.
Same challenges, any scale
Whether you're processing billions of API requests daily or just starting out on your next idea, the core priorities are the same. These are a few of the ways we've used GitHub over the past year to build our platform securely, improve our own developer experiences, and foster an environment where teams can be more productive, collaborative, and secure—while also being more creative and happier in their work.
