GitHub logo

GitHub

github.com Information Technology & ServicesSan Francisco, USLast updated: 10 Sep 2026

Risk Score

40/ 100
C

Bottom Line

Developer platform inside Microsoft. Well-evidenced assessment and strong certs; recent internal breaches and unlimited AI data retention keep governance pressure on.

Security questionnaire

Public evidence mapped to 52 security questions for GitHub. Questions without a supported answer are marked Undisclosed.

Questions answered43/52

AI Posture

AI-Enhanced
AI posture score62/100

LLM providers

AnthropicOpenAI

Data handling & training

Training policyTrains on data · Opt-out available
Training scopeStandard consumer
Third-party sharingShared with third parties
AI data retentionUnlimited retention

Customer controls

Disable AICannot disable AI
Granular controlsPartial opt-out available
Training opt-outOpt-out available

AI security & compliance

Compliance frameworksISO 42001

See how Shift helps you understand your organization's AI exposure.

Understand your exposure to GitHub.

Shift connects vendor security information to your organization's access and integrations to help you understand what is exposed.

Score breakdown

How the five categories combine into the overall risk grade.

Risk Score
40/ 100

Category contributions, sorted by weight.

External Exposure40%
What attackers can see
22/ 100
D
Company Posture30%
Structural readiness
59/ 100
C
Breach History15%
Time-decayed recency
20/ 100
D
Certificates10%
Verifiable attestations
80/ 100
A
Supply Chain5%
Direct-dependency health
55/ 100
C

Understand your vendor exposure

Connect vendor security information to your organization's access and integrations with Shift.

Shift for enterprise

Breaches

Disclosed incidents and active campaigns targeting GitHub.

Breach History score20/ 100

Jul 8, 2026

GitHub Agentic Workflows Targeted in Prompt Injection Vulnerability (GitLost)

www.securityweek.com
Jun 13, 2026

github internal Targeted in Ransomware Attack by lapsus$

www.ransomware.live
Jun 9, 2026

GitHub Targeted in Data Breach

www.bleepingcomputer.com
May 1, 2026

GitHub Targeted in TeamPCP Internal Repository Breach

The Hacker News