github.com
Intelligence Briefing
01Target Assessment: github.com — Verdict: Well-Hardened. No active threat indicators detected across 15 intelligence sources. TLS posture is excellent: TLSv1.3 only, DigiCert ECC certificate valid through March 2027, HSTS preload enforced with includeSubDomains. No downgrade vectors identified. Threat intelligence feeds are clean. GreyNoise classifies the primary IP as benign. Zero ThreatFox IOC matches. Zero URLhaus malicious URL records. The single OTX pulse is a 2019 historical entry with no active threat association. Email security is properly configured: SPF with ~all softfail, DMARC at p=reject with a dedicated reporting address, DKIM inferred from MX alignment with Google Workspace routing. Security headers cover the essentials — HSTS, X-Frame-Options: deny, X-Content-Type-Options: nosniff, Referrer-Policy set. Only notable absence: Content-Security-Policy on the root domain. The only measurable risk surface is scale: 47 enumerated subdomains via Certificate Transparency. Each represents an additional attack surface entry point. GitHub's security team maintains a public bug bounty program and manages subdomain inventory actively. DNSSEC absence at the registrar level is mitigated in practice by HSTS preloading. Analyst confidence: HIGH — all findings corroborated by at least 3 independent sources.
Executive Summary
02Strong passive signal profile
github.com presents an excellent security posture. HSTS with preload is enforced, TLS 1.3 is the minimum accepted protocol, and no active threat indicators were found across 20+ intelligence feeds. The subdomain footprint is extensive but expected for a platform of this scale. Two informational findings are noted: absence of Content-Security-Policy on the root domain and DNSSEC not enabled on the registrar side.
- Consider implementing Content-Security-Policy header on github.com root
- Enable DNSSEC at MarkMonitor registrar for additional DNS integrity
- Review subdomain inventory periodically — 47 subdomains represent a broad attack surface
Target Intelligence
03Findings (3)
04| ID | Severity | Finding |
|---|---|---|
| f-001 | MEDIUM | Content-Security-Policy Header Not Present The root domain does not return a Content-Security-Policy header. While GitHub uses other mitigations (trusted types, SameSite cookies), the absence of CSP on the main domain is a deviation from best practice. HTTP response headers from github.com:443 contain no Content-Security-Policy directive. Implement a strict Content-Security-Policy header with script-src, object-src, and base-uri directives. |
| f-002 | LOW | DNSSEC Not Enabled DNSSEC is not configured on github.com, leaving DNS responses unsigned. This creates a theoretical vulnerability to DNS cache poisoning, though the risk is mitigated by HSTS preloading. WHOIS: DNSSEC: unsigned. dig DS github.com returns NODATA. Request DNSSEC enablement through registrar MarkMonitor. |
| f-003 | INFO | 47 Subdomains Enumerated via Certificate Transparency Certificate transparency logs reveal 47 active subdomains. This is expected for a platform of this scale and does not indicate a vulnerability. Periodic review is recommended to ensure all subdomains are intentional. api.github.com, gist.github.com, education.github.com, copilot.github.com, docs.github.com and 42 others found in CT logs. |
Open Ports (3)
05| Port | Protocol | Service | Product / Version |
|---|---|---|---|
| 443 | tcp | https | nginx |
| 80 | tcp | http | nginx |
| 22 | tcp | ssh | OpenSSH 8.9 |
TLS Certificate
06DNS / WHOIS
07| Platform | Page | Name | Public text |
|---|---|---|---|
| A 192.0.2.4 | A 192.0.2.4 | — | Existence only. Title and bio were not extracted in this scan. |
| A 192.0.2.3 | A 192.0.2.3 | — | Existence only. Title and bio were not extracted in this scan. |
| NS ns1.p16.dynect.net | NS ns1.p16.dynect.net | — | Existence only. Title and bio were not extracted in this scan. |
| NS ns2.p16.dynect.net | NS ns2.p16.dynect.net | — | Existence only. Title and bio were not extracted in this scan. |
| MX aspmx.l.google.com | MX aspmx.l.google.com | — | Existence only. Title and bio were not extracted in this scan. |
| MX alt1.aspmx.l.google.com | MX alt1.aspmx.l.google.com | — | Existence only. Title and bio were not extracted in this scan. |
| MX alt2.aspmx.l.google.com | MX alt2.aspmx.l.google.com | — | Existence only. Title and bio were not extracted in this scan. |
| host api.github.com | host api.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host gist.github.com | host gist.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host raw.githubusercontent.com | host raw.githubusercontent.com | — | Existence only. Title and bio were not extracted in this scan. |
| host codeload.github.com | host codeload.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host education.github.com | host education.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host copilot.github.com | host copilot.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host docs.github.com | host docs.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host support.github.com | host support.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host status.github.com | host status.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host training.github.com | host training.github.com | — | Existence only. Title and bio were not extracted in this scan. |
| host resources.github.com | host resources.github.com | — | Existence only. Title and bio were not extracted in this scan. |