GitHub lists six free settings to lock down repos

GitHub published a list of six security settings it says every repo maintainer should turn on, all free, all fast to enable, per the GitHub Blog.

For solo builders and open-source maintainers, this is a low-effort pass that raises the bar against opportunistic attacks, not sophisticated ones, per GitHub's framing.

None of the six settings cost money or need a security team to enable, and GitHub says they're already sitting in every repo's settings tab.

GitHub doesn't tie the checklist to one specific breach. It presents the six items as a maintainer's routine task, per the post.

The cost isn't the excuse

The gap here isn't budget. It's attention. A checklist that takes an hour and costs nothing still gets skipped by maintainers juggling code review, issues, and everything else a repo needs.

GitHub's own advice is to do it in the next hour, not schedule it for later. If you maintain a public repo, that's the whole ask: open the settings tab and work through the six items once.