Why We Require GitHub Login? From Convenience to Security

At the early stage of GitHubCard, one feature we were proud of was "zero barrier"—users could create and share beautiful GitHub cards without logging in. Our intention was to lower the barrier to entry so that as many users as possible could quickly experience the value of the product.

However, as the user base grew and community feedback deepened, we found that this "fully open" model brought a security risk that could not be ignored. To protect the hard work of every creator, we made a decision: to fully enable GitHub login verification.

In this article, we will candidly share the thinking behind this decision and what it means for you.

Discovering the Problem: When "Convenience" Becomes a "Vulnerability"

The initial design logic was simple: anyone could edit a design on the canvas, and after clicking save, the system would generate a unique design ID (e.g., afB0FP_V). As long as you had this ID, you could update the design content via the API.

This design was very convenient for small-scale use, but as a keen user reported to us, it had a serious IDOR (Insecure Direct Object References) vulnerability:

"The project looks very nice, but it’s possible to vandalize other users’ cards/profiles:

Let's say user A creates a card with custom design id afB0FP_V and embeds the created card in their GitHub profile. Then user B can see in user A's profile which design id the card uses and make a request to the githubcard.com API to update this design and completely change its contents. This overrides user A's design and allows user B to vandalize user A's GitHub profile."

In short:

1. Your design ID is public (because you embedded it in your README or personal website).
2. Since there is no authentication, malicious users only need to know your ID to send an update request to our server.
3. They can instantly replace your carefully crafted card with any inappropriate content, or even clear your design.

This is unacceptable to us. Your GitHub Profile is your digital facade, and we will never allow it to face the risk of malicious graffiti.

Our Solution: Identity as Defense

To completely eradicate this risk, we introduced an authentication mechanism based on GitHub OAuth and implemented the following security policies:

1. Mandatory Ownership Verification

Now, when you create a new design, the design is permanently bound to your GitHub account.

• Only you, as the design owner, have the permission to modify or delete the design.
• Other users cannot make any changes even if they know your design ID.

2. Secure API Design

Our backend interfaces now strictly check the Authorization header for every write operation (Create/Update/Delete). If there is no valid Token, or if the user belonging to the Token does not match the design owner, the request will be rejected immediately.

3. Read-Only Public Access

Don't worry, design display is still public. The SVG/PNG links you generated (such as https://githubcard.com/Cactusinhand.svg?d=JkKGFDBE) can still be accessed and embedded by anyone, but these interfaces are read-only and absolutely safe.

Extra Benefits of Login

In addition to security, the login mechanism also opens up more possibilities for us:

• Full Control: Your designs are now firmly bound to your account. Only you, verified via GitHub, can access edit permissions anytime, anywhere, completely eliminating malicious operations by anonymous users.
• Higher Quota: Logged-in users will have higher GitHub API call quotas.

Final Words

Although there is one more login step, this is also to ensure that everyone's designs are safely stored in the cloud.

Thank you for your understanding, and we hope you continue to have fun! If you have any questions, feel free to give feedback on Feedback at any time.

When you are ready to create a protected design, use the GitHub profile card generator or the GitHub repo card generator.

Enjoy!

---

GitHubCard Team