GitHub

GitHub started as Git hosting, but most projects now use it for more than repositories. Pull requests, Actions, package registries, Codespaces, Dependabot, releases, and project automation all sit around the code.

That makes GitHub part of the delivery path. A leaked token, compromised package, or over-trusted workflow can affect production even if the application code is fine.

For small projects it is convenient to have everything in one place. For serious systems, treat that convenience with respect: lock down Actions permissions, review secrets, pin dependencies where it matters, and know which packages your workflows publish.