I ditched GitHub and self-hosted my own private alternative
I love GitHub, and have used it for many, many years. GitHub isn't always the best choice for code revisioning though. When I started building some private apps, I decided to look into alternatives and ended up self-hosting my own private git-based server instead.
GitHub is great for large or public projects
I love finding free open source software on GitHub.
Listen, GitHub is awesome. It's a fantastic resource for open source projects, and it's also a great repository for free open source software . I have been using GitHub for the better part of the past 15 years in varying capacities.
From building Android ROMs to deploying fully open source projects that I use in my homelab, GitHub has a special place in my heart. It's a simple platform, gives people a central location to search for software, and has become a go-to for code revisioning and open sourcing software, even for large companies like Apple or Microsoft .
GitHub offers "private" projects, but it's not guaranteed privacy
Private projects are only as private as your GitHub account is.
Back when I was doing a majority of my GitHub contributions several years ago, GitHub actually charged for private repositories. It was one of the main reasons to get a paid GitHub plan —being able to have private repos. In 2019, GitHub lifted that restriction and started allowing free users to create private repositories.
This is a huge feature if you didn't realize that GitHub offered free private repositories. Having a massive site like GitHub for handling your projects is fantastic, and adding contributors is super simple. However, projects on GitHub aren't always "100% private."
GitHub might be a private company itself, but it's actually owned by Microsoft . That can be a problem for some people. All code stored on GitHub is protected by TLS encryption when uploading, but it's not encrypted any further than that. Technically, GitHub, and its parent company Microsoft, could access your code at any time, even if a repository is marked private.
This might not be a huge issue for many, but if you have code that you really don't want anyone else to access, storing it on servers that other people could access—either by desire or lawful order—could pose a problem. That's why some of my code simply doesn't live on GitHub.
Apps that I'm writing where I want to retain 100% ownership over the code start to finish, I refuse to put on GitHub. There's just too many risks involved for me to host the code there. Public code that I want to share with the world? That belongs on GitHub, and I'll gladly post it for all to see.
Self-hosting my own GitLab instance puts me in complete control over the projects
I'm in charge of how secure my home server is.
Lucas Gouveia / How-To Geek
The code that I want to keep safe and secure lives on my own server in my own house. I chose to use GitLab as my git interface on the server, and I have no regrets at all with it. While GitLab offers hosted and managed plans, it also offers the ability to self-host . GitLab has many of the same features that GitHub does, including issue tracking, CI/CD functionality, webhooks, and more.
With GitLab, I can technically host public repositories too, but I choose to keep everything private to my only user on the platform. With the service being hosted at my house, I could choose to block external network access, open it through something like Tailscale or Cloudflare Tunnels, or put it behind a reverse proxy . I'm the one who chooses how secure the data is.
Also, I'm the only one with the encryption keys and physical access to the server. The data I store on it is mine and mine alone. This might sound a bit paranoid, but some of the programs that I'm working on I don't want anyone else to see the source code of. I am spending a lot of time developing certain programs and I want them to remain mine.
Could someone reverse engineer the apps that I release to find the source code? I'm sure, but that takes a lot more sleuthing and work than just stumbling upon a repo someone forgot to mark as private. Or, worse yet, that someone broke into because an online account was compromised.
When it comes to my private repositories, I just like to be the one in control of how secure they are, not someone else. GitHub works well for many people, and the private repos could do exactly what you need them to.
However, at the end of the day, your code is only as secure as your GitHub account (or GitHub itself…or even Microsoft itself), with little for you to do if something is compromised.
