Keeping Secrets: Lessons Learned From Securing GitHub

In their talk "Keeping Secrets: Lessons Learned From Securing GitHub" at RubyKaigi 2025, speakers Dennis Pacewicz and Wei Lin Ngo explore critical lessons learned from a significant security incident involving GitHub. They delve into the dual facets of security—offensive and defensive—providing crucial insights for developers, particularly those working with Ruby.

Key Points Discussed:

Introduction to Speakers: Dennis from GitHub and Wei from Pritorian introduce themselves, highlighting their backgrounds in application security and vulnerability assessment.
Offensive Security Journey: Wei recounts a personal experience of discovering a major vulnerability in GitHub right after Christmas 2023, which granted him access to sensitive production secrets, including commit signing keys and cloud access keys. He details the discovery process, the exploitation methods used, and the importance of promptly reporting vulnerabilities to responsible teams.
Vulnerability Details: Wei explains the nature of the vulnerability related to the misuse of the send method in Ruby, which could potentially allow attackers to execute arbitrary code. He emphasizes the risks associated with unvalidated user inputs and illustrates how he exploited this weakness to reveal environment variables.
Defensive Mitigation: Dennis outlines GitHub's response strategy to vulnerabilities reported through their bug bounty program. This includes triage, containment, and remediation efforts, with a specific focus on the necessity of cross-team collaboration during incident response. He provides advice on practical code changes made as a result of the vulnerability, emphasizing a blameless culture in their team environment.
Code Security Tools and Recommendations: The speakers advocate for the use of various code scanning tools such as Brakeman, RuboCop, and CodeQL to identify vulnerabilities proactively before they can be exploited. They stress the importance of guarding against dangerous code practices and ensuring sound input validation.
Managing Secrets in Ruby: The talk concludes with a discussion on best practices for managing secrets in Ruby applications. They recommend using secret management tools and processes to handle sensitive data securely and emphasize routine secret rotation as a preventive measure against potential leaks.

Key Takeaways:

Maintain rigorous security practices, especially when utilizing powerful Ruby features.
Adopt security scanning tools to uncover and mitigate vulnerabilities early in the development process.
Educate developers on the importance of validating inputs and securely managing application secrets to safeguard applications against potential breaches.