Pentest Agent

github.com

Public security posture · Completed

Share on X

Security grade

A
Configuration score94/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
0
Medium
2
Low
1
Informational
17 of 20 assessed checks passed

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://github.com/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
301 → https://github.com/
HSTS is enabledPassed
Browsers are told to use HTTPS for 365 days, including subdomains.
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload
Legacy TLS versions are refusedPassed
The server refused handshakes offering only TLS 1.0 or TLS 1.1.
TLS 1.0
rejected
TLS 1.1
rejected

HTTP security headers

1 finding
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
Content Security Policy is enforcedPassed
Script sources are restricted by an enforced policy.
Content-Security-Policy
default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazona…
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
deny
CSP frame-ancestors
'none'
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
origin-when-cross-origin, strict-origin-when-cross-origin
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
All cookies are SecurePassed
3 cookies checked.
Cookies
_gh_sess, _octo, logged_in
Session cookies are HttpOnlyPassed
Cookies that look like sessions can't be read by JavaScript.
SameSite set on all cookiesPassed
Cross-site cookie behaviour is explicit.

DNS & email posture

1 finding
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
CAA records publishedPassed
Certificate issuance is restricted.
CAA github.com
0 issue "digicert.com"
CAA github.com
0 issue "globalsign.com"
CAA github.com
0 issue "letsencrypt.org"
CAA github.com
0 issue "sectigo.com"
CAA github.com
0 issuewild "digicert.com"
CAA github.com
0 issuewild "letsencrypt.org"
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all
DMARC enforced (p=quarantine)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.github.com
v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1

Frontend & disclosure

1 finding
lowPotential · needs review

1 external script origin without integrity checks

Scripts from other domains run with full access to the page. If one of those hosts is compromised, the change reaches your users immediately.

Script origin
https://github.githubassets.com
Recommendation · Self-host critical scripts, or pin versioned files with an integrity attribute. Prioritise anything that touches wallet connections.
Why it matters ↓

Compromised third-party scripts are a leading cause of wallet-drainer incidents. SRI makes the browser refuse a script that has been altered.

How we check: Lists scripts loaded from other domains and checks whether they use Subresource Integrity (integrity attribute).

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
security.txt publishedPassed
Researchers have a documented way to report vulnerabilities.
Contact
https://hackerone.com/github

Scope & limitations

Assessment type
Public, non-invasive
Target
github.com
Final URL
https://github.com/
Resolved addresses
140.82.116.4
Scanned
Oct 20, 2026, 11:09 UTC
Duration
0.7s
Requests made
12 (budget 60)
Report ID
fksbj3s8hz
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage and a small set of well-known paths were requested. Other pages and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.

Own github.com? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.

github.com security report · Grade A · Pentest Agent