You know what'll wake you up faster than a cold nose on your ankle at 5 AM? Findin' out someone pushed malware to your codebase while you were sleepin'. And the one thing that could've stopped it? GitHub wanted four bucks a head for it.
Let me back up.
The Worm Came Knockin'
Early February, our repos got hit by something called Shai-Hulud — named after them giant sandworms from Dune. Nasty piece of work. Hid itself behind 2,000 spaces of whitespace in config files. Invisible in a diff. Invisible in review. Quiet as a cottonmouth in tall grass.
And the worst part? You can't see it. Open the infected file in VSCode — looks perfectly normal. Clean imports, clean config, nothin' out of place. The malicious code sits past column 2,000, way off the right edge of your screen. No word wrap hint, no scrollbar clue. Your config file looks clean. It ain't.
Pop it open in vim with :set nowrap and scroll right? There it is. Hundreds of characters of obfuscated JavaScript — minified, mangled, with a version stamp baked in. Sittin' right there in your vite config, invisible to anyone who didn't go lookin' for it. VSCode won't show you. GitHub's diff view won't show you. But the malware's runnin' just fine.
Eighteen minutes. That's all it took to push that invisible payload across multiple repos. Stole credentials, tokens, environment variables — shipped 'em off to some server across the ocean. And if you blocked the phone-home? Kill switch. Wiped your whole home directory. Like a coon hunt gone sideways in a hurricane.
Here's the kicker: the repos with branch protection stopped it cold. Required a pull request review? Attacker bounced right off. No protection? Compromised in seconds.
Two repos locked. Two repos open. Guess which ones got hit.
The Personal Account Problem
Here's somethin' nobody talks about until the barn's already burnin'.
Your contractors and employees? They want to use their personal GitHub accounts. Makes sense — they want that green contribution graph. They want credit. Their commit history is their resume. Can't blame 'em.
But here's the rattlesnake in the woodpile: their personal repos can infect your business ones. Same machine, same SSH keys, same tokens. Shai-Hulud didn't care which org owned the repo. It swept through every account on the compromised machine. One dev installs a poisoned npm package on a side project Saturday night, and Monday mornin' your production repo's got malware in it.
Personal account gets popped? Every org they touch is exposed.
How We Locked It Down
After the attack, we didn't just flip switches. We rebuilt the whole approach.
Signed GPG commits. Every developer generates a GPG key, registers it with GitHub, and signs every commit. If a commit ain't signed, it didn't come from us. Spoofed commits — where an attacker pushes code pretending to be someone else — show up "Unverified" in big ugly letters. No more mystery meat in the git log.
Separate GitHub accounts for business. We created dedicated org accounts — ccc-username — for the company. Personal accounts stay personal. Business accounts stay on business machines. Different SSH keys, different tokens, different blast radius. If someone's personal account gets compromised on their weekend laptop, the company org doesn't feel it.
gh CLI to manage the split. GitHub's CLI lets you switch auth contexts clean: gh auth switch --user ccc-username. No juggling SSH configs, no prayer-based token management. One command, you're in the right account. We scripted the audit too — loop through every repo, check branch protection, flag the gaps. Took ten minutes to lock down 25 repos.
Branch protection on every single repo. Not most. Not the important ones. Every one. We audited the whole org in one session — found five repos unprotected, locked 'em all down. One required review. No force pushes. No branch deletion. Same rules, no exceptions.
The Part That Burns
We had a paid plan. We could do all of this. GPG enforcement, branch protection, the works.
But we've got another org on GitHub's free plan. Went to add branch protection after the attack. GitHub said no. Upgrade to Team. Four dollars per user per month.
Can't require pull request reviews. Can't block force pushes. Can't prevent branch deletion. Nothin'. Your main branch is wide open and there ain't a switch to flip.
GitHub — owned by Microsoft, a three-trillion-dollar company — charges you to lock your front door.
It Ain't a Power Feature
Branch protection ain't some fancy enterprise tool. It's the bare minimum:
Somebody reviews the code before it hits main
Nobody force-pushes over history
Nobody deletes production branches
That's a deadbolt. That's not a smart home security system. And every single one of those would've stopped Shai-Hulud on our unprotected repos.
Meanwhile, GitLab? Free. Bitbucket? Free. GitHub's the outlier, not the standard.
The Hypocrisy
GitHub pumps out Dependabot, secret scanning, CodeQL, throws money at the OpenSSF — all in the name of supply chain security. Then locks the most basic branch protection behind a paywall.
That's like buildin' a state-of-the-art alarm system and chargin' extra for the deadbolt.
The software industry spent three years hollerin' about SolarWinds, Log4j, XZ Utils. Now Shai-Hulud's rippin' through repos and the platform where most of the world's code lives won't let free users lock a branch.
What I'd Tell You
If you're on the free plan — know the risk. Anybody with write access can push straight to main. Right now. No review. No protection.
If you're on a paid plan — audit every repo tonight. We had a paid plan and still had gaps. The worm didn't need a zero-day. It just needed one unlocked door.
Either way — talk about it. Most folks don't know this until after the fire.
Branch protection should be free. Every plan. Every repo. Public and private.
The tide always comes back in. So does the next attack. And right now, GitHub's got millions of repos sittin' there with the door wide open and no way to close it.
That ain't a feature gap. That's negligence with a price tag.