Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-02 · high
GitHub says it's the best security return per minute you'll spend all month, urging maintainers to act before they close the tab.
Why now: As of July 2, GitHub isn't attaching a deadline, but every day these six settings stay off is a day a free fix goes unused.
GitHub published a checklist of six settings that closes the easy doors on public repos at zero cost, per its security blog.
GitHub calls it the highest security return per minute you'll spend all month, for anyone who maintains anything public. That's the stakes for a repo other people already depend on.
The post doesn't name the six settings here, only the pitch: zero cost, a high return, and urgency. It ends with a nudge to act before you close this tab. That's worth knowing before you click through to read the checklist yourself. It also doesn't say whether GitHub plans to turn any of these on by default later.
The move for anyone maintaining a public repo is simple. Open the checklist, work through the six settings, and turn on whatever applies before doing anything else today.
Skipping the list isn't neutral. It's a bet that nothing exploits the gap before you get around to it. On a public repo with real traffic, that's a bad bet.
GitHub isn't attaching a deadline. But every day these six settings stay off is a day a free fix goes unused.
Each link below shares sources, entities, or timing with this story.
Shared entity: GitHub / Same source / Shared topic / Tension
Both cover GitHub; cite the same source (checklist); overlapping topics (clos, door, free, security, setting).
Shared entity: GitHub / Same source domain / Shared topic / Earlier coverage
Both cover GitHub; reported by the same outlet (github.blog); overlapping topics (cost, month).
Both cover GitHub; reported by the same outlet (github.blog); overlapping topics (free, setting).
Shared entity: GitHub / Same source domain / What happened next / Tension
Both cover GitHub; reported by the same outlet (github.blog); picks up the GitHub thread on 2026-08-13.
Both cover GitHub; reported by the same outlet (github.blog); picks up the GitHub thread on 2026-08-08.
Both cover GitHub; reported by the same outlet (github.blog); picks up the GitHub thread on 2026-07-31.
Both cover GitHub; reported by the same outlet (github.blog); picks up the GitHub thread on 2026-07-29.
Both cover GitHub; reported by the same outlet (github.blog); picks up the GitHub thread on 2026-07-29.