GitHub does a pretty good job requiring oauth or ssh key authentication, and the new finely-grained personal access are awesome, I just switched all my apps to use more locked down PATs.<p>The far you reach from GitHub's ecosystem, that's where most of the vulnerabilities are.<p>Repo-specific deploy keys, read-only keys and branch protection are my "pro" security hardening steps.<p>Shoving all secrets in ENV isn't a clear improvement either. Sure, most CI services attempt to mask them, but it's trivially to extract the secrets. For GitHub, you have to approve incoming first-time PRs, but it's a huge vector someone determined can exploit.