THREAT MODELING GITHUB - HOW VULNERABLE-BY-DESIGN IS GITHUB?

Summary from the TLDR InfoSec newsletter

GitHub was built around the principles of openness and collaboration to facilitate open-source development. As the platform has matured, it has become an enterprise standard, and trade-offs between openness and security have revealed its inherent security flaws. This post looks at access control, GitHub Actions and CI/CD, Secrets Management, and Repository security design issues, as well as supply chain and SHA1 collision attacks.