[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Don't Git Attacked: How Git Protects Against Source Code Exposure](/blog/git-risk) Publish date July 11, 2025 {x} minute read # Don't Git Attacked: How Git Protects Against Source Code Exposure [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Caitlin Postal](/team/caitlin-postal) Technical Writer Reviewed by Table of contents Free resource ### [Download now](#) Git is a distributed version control system that empowers developers with version control features and local repositories. In most production settings, Git is paired with a hosted service for distributed access with minimal repository configuration requirements. However, using a hosted server for source control can introduce new attack vectors in source control management (SCM). This article provides suggestions for security concerns around Git use. ## What is Git? Git is the preeminent source control management tool used by software development professionals to manage production code for a variety of apps. Git repositories track historic data for a set of files and can be set up with continuous integration and continuous deployment (CI/CD) workflows for high availability applications. While you can run your own Git server, many developers opt for a third-party service to manage functionality for a distributed Git server. Hosted services include [GitHub](https://www.upguard.com/security-report/github), [GitLab](https://www.upguard.com/security-report/gitlab), [BitBucket](https://www.upguard.com/security-report/bitbucket), and Azure Repos with [Azure DevOps](https://www.upguard.com/security-report/microsoft-azure). Open-source alternatives like Gitea and [SourceForge](https://www.upguard.com/security-report/sourceforge) require manual configuration, which may not be desirable to some developers. With a Git repository, files are committed to the server. If connected to a hosted service, the files are typically submitted through a pull request (PR) or a merge request (MR) for code review, though the exact terminology depends on the service. For example, GitHub uses PRs, whereas GitLab uses MRs. As part of your version control process, you might include linting requirements for commits to enforce a style guide on any source code. If you use a third-party server to host your code repository, you can choose whether the repo is public or private. Many organizations opt to maintain private repositories for production code to protect the company's intellectual property and proprietary software. Private repositories also add a layer of security if there are [passwords](https://www.upguard.com/blog/the-password-security-checklist) or [personally identifiable information](https://www.upguard.com/blog/personally-identifiable-information-pii) (PII) inadvertently embedded in the source code. However, some organizations do their work in public repos, which empowers the developer community to provide feedback through bug tracking issues or open-source contributions. It is beneficial to add a security policy to any repository and especially for public repositories. ## Git security issues If your production code is hosted in a third-party repository server, you should take care to control access and set security policies. If an attacker gains access to your organization's source code, they can accomplish any number of nefarious actions like [data exfiltration](https://www.upguard.com/blog/how-to-detect-data-exfiltration), configuration file changes, malicious code insertion, [malware](https://www.upguard.com/blog/malware) uploads, and more. If the attacker has achieved [privilege escalation](https://www.upguard.com/blog/privilege-escalation), they could potentially delete the repository or perform arbitrary code execution in your application. Requiring user security permissions ensures that your repos are only accessible by authorized users, whether your organization uses GitHub repositories or another hosted service. Your third-party service may offer security features for access control and encryption. However, Git stores plain text data, so it is critical to check your code and its metadata for any credentials that should not be exposed. In order to store that code in a cloud-based repository, you have to be able to communicate from your local `[.rt-script]git[.rt-script]` server to the third-party service. To achieve this communication, you must provide a path between the services, which is typically accomplished by opening a dedicated port. The Git protocol uses port `[.rt-script]9418[.rt-script]`, which does not offer any authentication or cryptography. This port is often closed in corporate environments due to the lack of security measures. Instead, you might use the SSH port `[.rt-script]22[.rt-script]` for encrypted and authenticated data transfer. ### How to secure Git use By requiring authentication for user-based permissions, you can ensure that only authorized users can access your repositories. Most third-party services offer SSH authentication and [multi-factor authentication (MFA)](https://www.upguard.com/blog/mfa-multi-factor-authentication) for added security measures. Private repositories will also limit access to your code storage and version control. Other methods to secure Git in your development process include the following: * Don't commit PII, passwords, API keys, or other sensitive data. * Use `[.rt-script].gitignore[.rt-script]` to exempt files from commits (especially if your work encompasses frequent file changes and you `[.rt-script]git commit .[.rt-script]` recursively). * Require MFA or two-factor authentication for access to hosted services. * Use an SSH key to connect to GitHub. * Implement access control for all repositories. * Require all PRs be signed with a cryptographic GPG key (no unsigned commits). * Use caution when cloning public repos or using open-source software dependencies. * Sync an audit log service to a notification channel so your team remains aware of security alerts for your repositories. * Set up linting automation your submissions to avoid commits with sensitive information like user credentials. Each of these suggestions protects your git repos against security risks that could be manipulated by hackers and malicious actors. ### How UpGuard can help UpGuard’s [data leak detection](https://www.upguard.com/product/breach-risk/threat-monitoring) capabilities discover sensitive data exposed in public GitHub repositories and other publicly-available online file storage solutions, and [UpGuard Breach Risk](https://www.upguard.com/product/breach-risk) scans for the open Git port: * **'git' port open** This finding identifies that the Git service is exposed to the internet. Check your configuration settings to ensure that you have closed port `[.rt-script]9418[.rt-script]` and require Git use over a more secure avenue. UpGuard also identifies public use of GitLab and potential security vulnerabilities in outdated versions of [Gitbook](https://www.upguard.com/security-report/gitbook). UpGuard also maintains a vulnerability library for cybersecurity CVEs (Common Vulnerabilities and Exposures) and monitors organizations for data breaches. Current UpGuard users with the Breach Risk feature can [log in and access their Risk Profile](https://cyber-risk.upguard.com/risk_profile) to search for this Git-based risk among their assets. If you're not a current UpGuard user and you want to run an automated scan of your assets with Breach Risk, [sign up for a trial](https://www.upguard.com/demo). Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 26, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)