Turn on GitHub's six free security settings this week

GitHub published a checklist of six settings that closes the easy doors on public repos at zero cost, per its security blog.

GitHub calls it the highest security return per minute you'll spend all month, for anyone who maintains anything public. That's the stakes for a repo other people already depend on.

The post doesn't name the six settings here, only the pitch: zero cost, a high return, and urgency. It ends with a nudge to act before you close this tab. That's worth knowing before you click through to read the checklist yourself. It also doesn't say whether GitHub plans to turn any of these on by default later.

The move for anyone maintaining a public repo is simple. Open the checklist, work through the six settings, and turn on whatever applies before doing anything else today.

Skipping the list isn't neutral. It's a bet that nothing exploits the gap before you get around to it. On a public repo with real traffic, that's a bad bet.

GitHub isn't attaching a deadline. But every day these six settings stay off is a day a free fix goes unused.