A recent application audit revealed several concerns regarding source code management practices. The most significant finding involves the storage of code in a private GitHub repository that remains tied to a former employee’s account. This configuration poses potential risks to code access and management.
As an auditor, I decided to conduct a deeper analysis of this finding.
Why is this a problem?
During the analysis of the application’s code, it was discovered that the repository’s history contains a previously deleted .env file containing the encryption key for the application’s data. While this file is not visible in the current file listing, it remains recoverable through the .git directory’s commit history. Additionally, this same encryption key is currently in use within the application’s testing environment.
This situation means that the security of the application’s code and data may rely entirely on the configuration of the former employee’s private account and his or her approach to secure information management. The client has no control over the code, which creates a risk of unauthorized access.
Potential security breaches would require access to the former employee’s account. This could happen as a result of another attack, such as phishing or password compromise by other means.
Technical details
During the analysis, several actions were taken that confirmed the existence of the risk:
- Account activity: The former employee’s GitHub account shows ongoing activity in various projects, demonstrating that the account remains active and outside organizational control.
- Commit history: The repository’s commit history indicates that the last commit was made approximately one year ago, coinciding with the end of the employee’s tenure at the company
- Social Media Analysis: A review of the former employee’s LinkedIn profile confirms their departure from the company approximately one year ago, creating potential data security risks due to continued repository access.
RECOMMENDATIONS
Repository Management
- Migrate all source code to company-controlled infrastructure to establish complete repository oversight and access control
- Implement regular access audits of critical resources, particularly source code repositories, to prevent unauthorized access
- Enforce two-factor authentication (2FA) for all repository access
- Implement branch protection rules to prevent direct pushes to main branches
Security Controls
- Establish a robust encryption key rotation policy with immediate key replacement protocols during security incidents
- Provide a secure, company-controlled work environment for all development activities
- Store all sensitive credentials in specialized key stores, not in repositories
- Deploy automated code scanning tools to detect security vulnerabilities
- Implement secure development practices and coding guidelines
Access Control Automation
- Deploy an automated access management system that synchronizes with HR processes to immediately revoke permissions upon employment termination
- Implement Data Loss Prevention (DLP) systems to monitor and control sensitive data movement across the organization
- Implement granular role-based access control (RBAC) with the principle of least privilege
- Create dedicated user groups for repository access to better manage permissions
- Regularly review audit logs and repository activity
