github.com security report

Certificate, security headers, email authentication, DNS, registration, and exposed hosts — from public sources.

39risk

Moderate

Some surface to tighten, nothing urgent.

0Critical

1High

1Medium

17Low

1Info

Collected 22 hours ago9.4sfrom cache

Headers—

unavailable

Domain—

unavailable

Certificate Transparency117
DNS resolution85
Network ownership0
CDN / WAF detection0
Exposed ports & CVEs0
Registration
DNS posture0
Email authentication0
Certificate
Security headers
Archived URLs
Analysis20

noteCertificate inspection is unavailable in this runtime.
noteNetwork ownership lookup is unavailable in this runtime; ASN and org are omitted.
noteCDN/WAF detection is unavailable in this runtime.
noteSecurity headers did not complete (Too many subrequests by single Worker invocation. To configure this limit, refer to https://developers.cloudflare.com/workers/wrangler/configuration/#limits). Results below are partial.
noteRegistration did not complete (Too many subrequests by single Worker invocation. To configure this limit, refer to https://developers.cloudflare.com/workers/wrangler/configuration/#limits). Results below are partial.

SPF and DKIM alone do not protect the From: address a person sees. Without DMARC, a spoofed message can pass SPF for some other domain and still display yours.
What to do
Publish `_dmarc.github.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@github.com"`, review the reports, then move to p=quarantine and p=reject.
asset: github.com
Nothing tells receiving mail servers which hosts may send as @github.com, so anyone can. Even a domain that sends no mail should say so, or it becomes a free spoofing target.
What to do
Publish `v=spf1 -all` to state that this domain sends no mail.
asset: github.com
codespaces-dev.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: codespaces-dev.github.com
copilot-billing-preview.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: copilot-billing-preview.github.com
dev-days.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: dev-days.github.com
dev.gtm.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: dev.gtm.github.com
examadmin-uat.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: examadmin-uat.github.com
examregistration-uat-api.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: examregistration-uat-api.github.com
examregistration-uat.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: examregistration-uat.github.com
graphql-stage.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: graphql-stage.github.com
jira.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: jira.github.com
lab-sandbox.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: lab-sandbox.github.com
staging-lab.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: staging-lab.github.com
stg.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: stg.github.com
vpn-ca.iad.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: vpn-ca.iad.github.com
workspaces-dev.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: workspaces-dev.github.com
www.graphql-stage.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: www.graphql-stage.github.com
www.jira.github.com appears in Certificate Transparency logs. Names like this usually front staging, admin, or internal tooling, which tends to be patched later and monitored less than production.
What to do
Confirm this host is meant to be public. If not, put it behind SSO or an allow-list.
asset: www.jira.github.com
Answers for this domain are not signed, so a resolver cannot tell a forged response from a real one.
What to do
Enable DNSSEC at your DNS host and publish the DS record at the registrar.
asset: github.com
Any public certificate authority may issue certificates for this domain. CAA lets you name the ones allowed to.
What to do
Add a CAA record naming your CA, e.g. `0 issue "letsencrypt.org"`.
asset: github.com

–No MX records — domain does not receive mail
✗SPF
no record
✗DMARC
no record
–MTA-STSn/a

!DNSSECanswers can be forged
–CAAany CA may issue
–IPv6 (AAAA)IPv4 only
✓0 nameservers

Address	Ports	Edge	Network
140.82.114.21 api.mcp.github.com	none known	direct	—
185.199.109.133 atom-installer.github.com +1	none known	direct	—
185.199.108.133 atom-installer.github.com +1	none known	direct	—
185.199.110.133 atom-installer.github.com +1	none known	direct	—
185.199.111.133 atom-installer.github.com +1	none known	direct	—
185.199.108.153 awesome-copilot.github.com +9	none known	direct	—
185.199.109.153 awesome-copilot.github.com +9	none known	direct	—
185.199.110.153 awesome-copilot.github.com +9	none known	direct	—
185.199.111.153 awesome-copilot.github.com +9	none known	direct	—
140.82.113.21 api.security.github.com	none known	direct	—
140.82.112.21 central.github.com +1	none known	direct	—
140.82.114.18 classroom.github.com	none known	direct	—
140.82.113.17 community.github.com +1	none known	direct	—
150.171.110.102 copilot-reports.github.com +1	none known	direct	—
185.199.108.154 docs.github.com	none known	direct	—
185.199.109.154 docs.github.com	none known	direct	—
185.199.110.154 docs.github.com	none known	direct	—
185.199.111.154 docs.github.com	none known	direct	—
140.82.114.22 education.github.com	none known	direct	—
140.82.112.22 enterprise.github.com	none known	direct	—
140.82.112.17 examadmin.github.com +1	none known	direct	—
20.118.56.3 examregistration-api.github.com +1	none known	direct	—
151.101.2.217 f.cloud.github.com	none known	direct	—
151.101.66.217 f.cloud.github.com	none known	direct	—
151.101.130.217 f.cloud.github.com	none known	direct	—

Archived URLs

Endpoints the Wayback Machine has kept — config files, backups, scripts. Slow to fetch, so it is here on request.

github.com security report

Moderate

Findings

Email authentication

DNS

Hosts

Hostnames