Product Habits - Managing access to GitHub/GitLab

I asked you how access to code in GitHub/GitLab is managed at your company.

Here’s what I learned.

Most people’s way of managing access to code repositories is through their onboarding/offboarding process. This starts as a simple checklist at smaller organizations and typically evolves into a more complex workflow and automation at larger organizations.

“There are onboarding/offboarding checklist. Each task in the checklist is managed by a person. Usually a manager is given the trigger to add/remove someone.”

“So part of the onboarding checklist is also to remove their accounts from the GitHub team.”

That all sounded fine and dandy to me. People described a very typical process that they have in place even at a 5-person startup.

But there’s a gap with these standard processes, a potentially major security gap. One person who replied really nailed the issue that persists which isn’t typically solved with the checklists and automated processes that organizations implement:

“One issue I found is that often, people are added manually to a repo instead of to a team.”

They continued on and described how this happens where they work.

“In those cases, sometimes someone still has access to a project because the onboarding/offboarding does not take into account those specific project cases.”

This tracks with everything we’re hearing from our customers. It’s manual, time consuming, and prone to errors to control who has access to GitHub and GitLab.

If this is something your company needs help with, reply and let me know.

Hiten

Copyright © 2022 Up Advisors, LLC., All rights reserved.
You received this email because you signed up to get emails from Product Habits.

Our mailing address is:

Up Advisors, LLC.

13337 South St. #269

Cerritos, California 90623

Add us to your address book

Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list

Product Habits - Managing access to GitHub/GitLab

Older messages

The most successful companies that almost failed

Find the fast-moving water

The best product-led growth examples

How is your code access managed?

How Segment found product-market fit

You Might Also Like

Youre Overthinking It

eBook: Software Supply Chain Security for Dummies

The 5 biggest AI prompting mistakes

An interactive tour of Go 1.24

Spyglass Dispatch: Bromo Sapiens

The $1.9M client

⚙️ Federal data centers

Post from Syncfusion Blogs on 01/15/2025

The Sequence Engineering #469: Llama.cpp is The Framework for High Performce LLM Inference

3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update