Git and Collaboration

Git is how modern teams — including security teams — collaborate on code, detections and documentation. This roadmap takes you from basic commits to secure, reviewed workflows. You only need a computer and a free GitHub account.

• Install Git and create a GitHub account
• Configure your name and email
• Plan your study time

• CyberA4U Academy — courses

Git tracks changes as commits in a repository. Knowing the working tree, staging area and history lets you work confidently and undo mistakes.

• Use init, add, commit, status, log and diff
• Understand the staging area
• Undo changes safely

Tools & tech: DevTools

• Pro Git book

Branches let people work in parallel. Teams choose a strategy — trunk-based, GitHub flow or Git flow — to keep work organized.

• Create, switch and merge branches
• Compare common branching strategies
• Choose one for a small team

Tools & tech: DevTools

• Pro Git — Branching workflows

Pull requests turn changes into a conversation: others review, test and approve before code reaches the main branch.

• Open a clear pull request
• Review others' changes constructively
• Protect the main branch with required reviews

Tools & tech: DevTools

• GitHub Docs — About pull requests

Conflicts happen when two changes touch the same lines. Resolving them calmly is a core collaboration skill.

• Understand why conflicts occur
• Resolve conflicts in an editor
• Test after resolving

Tools & tech: DevTools

• Pro Git — Basic branching and merging

Signed commits prove who authored a change and that it wasn't altered — important for security-sensitive repositories.

• Set up SSH or GPG commit signing
• Verify signatures
• Require signed commits on protected branches

Tools & tech: DevTools

• Pro Git — Signing your work
• GitHub Docs — About commit signature verification

Passwords and API keys committed to Git are exposed forever in history. Scanning catches them before and after they're pushed.

• Enable secret scanning and push protection
• Run a scanner locally
• Rotate any leaked secret immediately

Tools & tech: DevTools

• GitHub — About secret scanning

GitHub Actions runs automated workflows — tests, linting, security scans — on every push and pull request.

• Write a workflow file
• Use triggers, jobs and steps
• Keep workflow secrets and permissions minimal

Tools & tech: DevTools

• GitHub Actions — Quickstart

Teams choose between one large repository or many small ones. Each affects access control, CI and ownership differently.

• Compare monorepo and polyrepo trade-offs
• Use CODEOWNERS for ownership
• Plan access control per repository

Tools & tech: DevTools

• GitHub Docs — About code owners

Security teams store runbooks, detection rules and incident notes in Git to keep them versioned, reviewed and easy to find in an emergency.

• Organize runbooks and rules in a repository
• Review changes like code
• Keep sensitive incident data out of Git

Tools & tech: DevTools

• Pro Git book

Writing documentation in Markdown next to code keeps it versioned, reviewed and up to date.

• Write clear Markdown documentation
• Review docs in pull requests
• Publish docs automatically

Tools & tech: DevTools

• GitHub Docs — Basic writing and formatting syntax

Tags mark releases; semantic versioning tells users what changed. Signed tags add trust.

• Create annotated and signed tags
• Apply semantic versioning
• Write release notes

Tools & tech: DevTools

• Pro Git — Tagging
• Semantic Versioning 2.0.0

A Software Bill of Materials lists the components in your software, making it possible to find affected products when a vulnerability is announced.

• Explain what an SBOM contains
• Generate an SBOM in CycloneDX or SPDX format
• Use SBOMs to answer "are we affected?"

Tools & tech: DevTools

• CISA — Software Bill of Materials (SBOM)
• CycloneDX

Check that you can collaborate securely with Git: branches, reviews, signed commits, secret scanning and automation.

• Run a full pull-request workflow
• Sign commits and protect branches
• Automate checks with Actions

• CyberA4U CTF Arena — practice challenges

You can now collaborate safely with Git. Continue with DevSecOps Pipeline, Python for Security or Detection Engineering.

• Keep contributing to repositories
• Choose your next roadmap
• Contribute to an open-source project

• CyberA4U CTF Arena — practice challenges