Repository security checklist

Baseline security checklist

• Enable strong account authentication.
• Never commit passwords, API keys or private keys.
• Use least-privilege repository and workflow permissions.
• Protect important branches.
• Run dependency and security checks.
• Review third-party GitHub Actions before trusting them.
• Rotate credentials immediately after suspected exposure.

Security is continuous

Repository security is not a one-time configuration task. Review access, dependencies, workflows and secrets as the project evolves.