---
title: GitHub Security
description: Secret scanning, dependency, and infrastructure-as-code checks on every commit and pull request — catching leaked credentials before they ship.
keywords:
  - GitHub security
  - secret scanning
  - source code security
  - dependency scanning
  - infrastructure as code security
---

# GitHub Security

A leaked API key in a commit history, a vulnerable dependency pulled in without review, or a misconfigured Terraform file merged straight to production — these are some of the most common ways breaches start, and they all happen inside the repository, long before an attacker ever touches your live infrastructure.

## Why Repository-Level Security Matters

Your source control is where every vulnerability begins its life — a hardcoded credential, an insecure default, a dependency with a known CVE. Catching these at the commit or pull-request stage is dramatically cheaper than catching them after they've shipped: no incident response, no rotation under pressure, no customer notification.

## What We Check

Alastor InfoSec's GitHub Security coverage runs continuously against every connected repository:

- **Secret scanning** — API keys, credentials, private keys, and tokens committed to code or accidentally left in commit history, including secrets buried in old commits that a simple grep of `HEAD` would miss.
- **Dependency and supply chain scanning (SCA)** — known-vulnerable packages, license risk, and dependency confusion attacks, flagged before merge.
- **Infrastructure as Code (IaC) checks** — Terraform, CloudFormation, and Kubernetes manifests reviewed for insecure defaults, overly permissive IAM roles, and public-by-default resources.
- **Branch protection and access review** — who can push directly to protected branches, whether required reviews are actually enforced, and where CI/CD tokens have broader scope than they need.
- **CI/CD pipeline security** — build pipelines reviewed for injectable steps, exposed secrets in logs, and third-party Actions running with excessive permissions.

## Built Into Your Existing Workflow

GitHub Security checks run on every commit and pull request, surfacing findings directly where your engineers already work rather than in a separate portal they have to remember to check. This pairs naturally with our [Code Security](/features/code-security) module for deeper application-level static analysis, giving you commit-level hygiene and code-level vulnerability detection from the same pipeline.

## Who Needs This

Any engineering team shipping code through GitHub — which is to say, nearly every modern software team — benefits from continuous repository scanning rather than relying on developers to remember secret hygiene manually. This is especially important for teams under SOC 2 or ISO 27001 audit scope, where source control access controls and secret management are standard control points auditors will ask about directly.

[Talk to our team](/about-us) about connecting your repositories for continuous GitHub security monitoring.