Post #3338039
2025-02-18 16:14 UTC
@cuu508@toot.lv @healthchecks_io@fosstodon.org In regards to security in general I would like to advice you to consider importing the GitHub App's long-lived private RSA key into something like an HSM, a Cloud KMS, a Vault instance, etc. While that doesn't prevent misuse it at least guards against the key fully leaking.
Replies (1)
-
@cuu508@toot.lv 2025-02-19 06:34
@andreas@mastodon.arrakis.se @healthchecks_io@fosstodon.org thanks, that would be a nice finishing touch, but I'm at the very basics currently: do I use OAuth apps or GitHub apps? How come GitHub doesn't have a guide, a tutorial, or a high-level design doc on how to implement a secure onboarding flow? Perhaps the API is not designed for what I'm trying to do? And how other people solved this? Stuff like that 🙂