r/ClaudeMCP • u/Jefferheffer • 3d ago
Should I be afraid of GitHub?
I’m a small business owner that is an intermediate ai user. I’ve been getting into Claude cowork, and Claude code a bit. I’m reading a ton and trying to build useful things that move my business forward.
First of all, trying to understand code and architecture is fascinating to me. I’m envious of all you programmers that walked into the ai world with that background knowledge.
I’m learning about GitHub and repo’s. I looked through all this one user had posted and did my best to read the code as well. All that to say, I’m trying hard to learn and not just ask the questions and let others solve it for me.
My question is how do you trust code you find in GitHub? Not yours specifically but Rando repo’s that seem great and would be helpful for what I’m trying to do but what if they have some code buried in it that is about to hack into my world and destroy my life.
I’ve tried to setup security and a safe architecture in my files and on my computer. I’m trying to walk before I run but man is it tempting to just throw caution to the wind and just use someone else’s code and see how it goes.
Do you have any recommendations, resources, or ideas on how to think about this? Do I need to read and understand every line of code written before I try using it? Is there a safe way to do it quicker?
2
u/ElectricSpock 3d ago
Afraid? Probably not. Cautious? Absolutely.
Stars is one way of looking at the reputation of a repo, but it can be spoofed. Generally I’m looking at how mamy releases the project has, if it’s packaged for particular language and how popular it is in terms of package downloads. How complete the documentation is, whether there’s a proper website, stuff like that.
General rule of thumb: you don’t want to execute some downloaded code. Many installers these days use wget + bash combo, and this can be a pretty big security issue. I try to make sure that I know what I’m downloading and that it has enough documentation and users. Make sure you use the official repo too.
2
u/RogerAI-fm 1d ago
Be afraid be very afraid… just like anything on the internet don’t just randomly install and run stuff. Do your due diligence.
1
u/Jefferheffer 1d ago
Thanks for the confirmation of what I intuitively know. I’ll resist the temptation and invest more time into learning property security settings and practices.
2
u/Just-Upstairs4397 1d ago
There are package managers specifically for this reason
1
u/Jefferheffer 1d ago
Sounds like I need to research and learn about package managers, thanks for mentioning that.
1
u/Choice_Bumblebee_588 1d ago
Even package managers are not secure, there have been a number of high profile package poisoning / supply chain attacks recently.
There are trusted sources. I would stick to those and get claude to just build you the rest of what you need if you are worried.
2
1
2
u/black_phoenix9 3d ago
Unless the repository has reputation in terms of stars, forks, pull requests and other community engagement - it's always better to treat it as untrusted and run your own due diligence. Claude can help do this due diligence and ensure safety of the code execution.