Using Azure, how do I make my GitHub project private??

Question

Hi. I started hosting a web app through Azure in January. I recently noticed that my GitHub project, which is connected to Azure, is not set to private. I tried changing it, but it is not possible because of security reasons. It says: "For security reasons, you cannot change the visibility of a fork.". Its the file that is forked from Azure-Samples/php-docs-hello-world.
Because of this, anyone can see my connection string in my connect.php file, making it super easy for anyone to i.e. drop all tables from my database.

How can I make this private??

Answer 1

1. To change the visibility of a forked GitHub repo from public to private, follow https://stackoverflow.com/questions/10065526/github-how-to-make-a-fork-of-public-repository-private
2. You should not store connection strings in a php file, but use for this purpose GitHub secrets or an external storage (such as Azure Key Vault)

---

hth Marcin

Answer 2

Hello @Chris Fauskanger Here are some steps you can take:

Create a new private repository: Since you cannot change the visibility of a forked repository directly, you can create a new private repository on GitHub. Clone the forked repository: Clone the forked repository to your local machine. You can do this by using the command git clone https://github.com/username/repository.git.

Push to the new repository: Push the cloned content to your new private repository. First, navigate to your cloned repository on your local machine. Then, remove the existing origin with the command git remote remove origin. Add the new origin pointing to your private repository with the command git remote add origin https://github.com/username/new-repository.git. Finally, push the content to the new repository with the command git push -u origin master.

Update Azure: Update your Azure Web App to point to this new private repository instead of the old one. Remove sensitive data: Since your connection string was previously exposed, it’s recommended to change it to ensure the security of your database. After changing it, update the connection string in your Azure Web App settings.

Use Secrets for sensitive data: For better security, consider using Secrets in GitHub or Azure Key Vault for storing sensitive data like connection strings. This way, the sensitive data is not exposed in your code.

Remember, once sensitive data is committed to a repository, it might still be accessible in the commit history even after you change the visibility or remove the file. Therefore, it’s crucial to change any credentials that were exposed.

---

If this information provided here helps solve your issue, please tag this as answered, so it helps further community readers, who may have similar questions.

Answer 3

Hi Chris, you would typically reference the secret during a deployment - as described in https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions

---

hth Marcin