What Is GitHub? Repositories, Branches, and Your First Project

GitHub is a website where people store, share, and review software projects. Most of those projects are tracked with Git, a version-control tool that records each change to a set of files. GitHub keeps Git repositories online, adds a web interface, and gives teams pull requests, issues, and releases to work on code together.

The short answer: Git is the tool, and GitHub is one of the places where Git projects are hosted and discussed.

#Git and GitHub are separate tools

Git runs on your own computer. You can turn any folder into a repository and record changes without an internet connection or a GitHub account.

GitHub is an online service. It stores copies of Git repositories, shows files and history in a browser, and adds features such as issue tracking and pull requests. Other services host Git repositories too, so GitHub is one place where Git projects live.

#Five terms to learn first

• Repository (repo): a project folder together with its full change history.
• Commit: a saved snapshot of changes, with a message that explains them.
• Branch: a separate line of commits. You work on a branch so the main line stays stable while you test an idea.
• Pull request: a request to merge the commits from one branch into another, usually after someone reviews the differences.
• Release: a named version the maintainers chose to publish, often with downloadable files attached.

Making a repository yourself is the quickest way to see what these words mean.

#Practice Git on your own machine

You do not need GitHub to learn the basics. Install Git from the official site at git-scm.com, then check the installed version:

git --version

On the Windows machine where this article was checked, the command printed:

git version 2.49.0.windows.1

Your output will show a different version. Next, set the name and email that Git attaches to each commit. Use your own values:

git config --global user.name "Your Name"
git config --global user.email "[email protected]"

Now create a practice repository with two branches and two commits:

mkdir security-learning-notes
cd security-learning-notes
git init
printf '# security-learning-notes\n' > README.md
git add README.md
git commit -m "Add README"
git switch -c add-glossary
printf -- '- DNS\n- HTTPS\n- hash\n- encryption\n' > glossary.md
git add glossary.md
git commit -m "Add glossary terms"
git branch

Running git branch on that repository printed this:

* add-glossary
  master

The asterisk marks the branch you are on. Your default branch may be named master or main, depending on your Git settings. On Windows, Git may also print warnings about line endings. Those warnings do not change the commits.

#Put the project on GitHub

GitHub's Hello World guide walks through this workflow in the browser. Menus and button names change over time, so follow the official guide if your screen does not match this text:

1. Create an account at github.com.
2. Create a new repository named security-learning-notes. Choose public or private.
3. Add a README.md file with one sentence that describes the project.
4. Create a branch called add-glossary.
5. Add a short list of terms and commit the change.
6. Open a pull request, read the diff, and merge it.

The pull request step matters even in a personal repository. The diff view shows exactly which lines changed before anything reaches the main branch.

To send a local repository to GitHub, create an empty repository on the site, then connect it from your terminal. OWNER and REPOSITORY are placeholders. Replace main with your branch name if git branch shows master:

git remote add origin https://github.com/OWNER/REPOSITORY.git
git push -u origin main

#Downloading a project

A git clone copies a repository with its full history:

git clone https://github.com/OWNER/REPOSITORY.git

Replace OWNER and REPOSITORY with the owner and name shown in the address bar of the project page. Cloning downloads files. It does not run anything from the project, and it does not prove the project is safe. A ZIP download from the website gives you the files without history, which is fine for reading but loses the commit trail.

#Check a project before you run it

Before you run a tool you have never used, check the repository itself:

• Is this the official upstream project, or a fork with an unknown owner?
• Is there a license, and does the README list the requirements clearly?
• Does the project publish releases? If it publishes checksums or signatures, verify the file you downloaded against them.
• Does install.sh or a setup script change system packages, install services, or ask for administrator rights?
• Which network connections and permissions will the tool need?
• Can you try it first in a container or a disposable virtual machine?

Read install scripts before you execute them. A README that tells you to paste a command into a terminal is asking you to run code on your machine.

Security tools are for authorized work. Practice on machines you own, on a lab you built, or on targets where you have written permission to test.

#Common beginner mistakes

Confusing Git with GitHub is a frequent one. Git works on your computer and needs no website. GitHub is a service built around Git.

Committing secrets is the second. A token or password pushed to a public repository can be copied by anyone who finds it. Deleting the line in a later commit does not remove it from the history. Revoke the credential first, then follow GitHub's guide to removing sensitive data from a repository.

Running commands from a README without reading them is the third. Install scripts can change your computer, so read them before you run them.

#Next step

The next article in this path covers creating a GitHub account and your first repository. Once these basics feel routine, you can start looking at security tools. Test each one in a lab you own before you trust it with anything real.