1. Guides
  2. What the heck is GitHub?

Basics

What the heck is GitHub?

Git, repos, commits, branches and pull requests in plain English, and why your AI builder and your host both ask you to connect it.

Sourced from vendor docs
Checked
20 Oct 2026
Read
4 min
Sources
11
How we check

Sooner or later your AI builder asks you to "connect GitHub", and your host asks which repository to deploy. This guide explains what both of those mean and why it's worth setting up early.

Git and GitHub are two different things

Git is a free, open-source tool that keeps the history of a project's files. It saves every snapshot, so you can see what changed and when, and go back to any earlier version.

GitHub is a website that stores Git projects online. It adds tools for working on them: reviewing changes, running automatic checks and scanning for security problems. GitLab and Bitbucket do the same job.

Put simply, Git is the save history, and GitHub is where that history lives online.

Six words you'll keep seeing

  • Repository (repo): one project, meaning all its files and folders plus their full history.
  • Commit: a saved snapshot of the project at one moment, with a short note about what changed. AI builders usually make commits for you.
  • Branch: a separate line of work. The main one is usually called main. You make a new branch to try something without touching main.
  • Pull request (PR): a proposal to merge the changes on one branch into another. It shows exactly what changed, so you, a teammate or a review tool can check it first.
  • Merge: bringing a branch's changes into another branch, usually main.
  • Push: sending commits from your computer (or your builder) up to GitHub.

Why your AI builder wants it

Connecting GitHub puts a copy of your project outside the builder. If you outgrow the tool, the code is already in a repo you own, and you can open it in any editor.

Take Lovable as an example. When you connect a project, it creates a new private repository and keeps it in sync both ways:

  • Changes you make in Lovable go to GitHub.
  • Changes pushed to the active branch come back into Lovable.

It syncs one branch at a time, normally main. Lovable's docs warn you not to delete the repository, because that stops the sync. The GitHub connection is available on every Lovable plan.

Why your host wants it

Hosts such as Vercel watch your repo and deploy it for you:

  • Pushing to the production branch (usually main) creates a production deployment. That's your live site.
  • Pushing to any other branch creates a preview deployment with its own web address, so you can check a change before it goes live. Opening a pull request to main does the same.
  • Merging that pull request sends the change to production.

One catch: on Vercel's free Hobby plan, you can't deploy from a private repo that belongs to a GitHub organisation. A private repo on your personal account works fine.

What it costs

GitHub's Free plan costs nothing. It includes:

  • unlimited public and private repos, with unlimited collaborators
  • 2,000 minutes a month of GitHub Actions, its tool for running automatic checks (free on public repos)
  • 500 MB of package storage

Paid plans start at Team. It costs $4 per user a month, as shown on GitHub's pricing page (checked 21 Oct 2026), which is about £3.00 at 1 USD = 0.7489 GBP. Our pre-launch security build uses only the Free plan.

Public or private?

Anyone can see a public repo. A private repo is visible only to you and the people you invite. Most app projects should be private.

Remember that Git keeps everything. If you delete a key in a later commit, it's still in the earlier ones. Anyone who can see the repo can see its history.

Two safety features to switch on

  1. Secret scanning and push protection. GitHub scans public repos for leaked keys automatically and at no cost. Push protection for your account is on by default, and it blocks you from pushing secrets to public repos. Private repos in an organisation need the paid GitHub Secret Protection. More in Keeping API keys out of your app.
  2. Dependabot. Your app relies on packages written by other people. - Dependabot alerts tell you when one of them has a known security flaw. - Dependabot security updates open a pull request that upgrades it to the first version with a fix.

Both are included on the Free plan. A repo admin turns them on in the repo's settings.

A sensible first setup

  1. Make a free GitHub account.
  2. Connect it to your AI builder and let the builder create a private repo.
  3. Import that repo into your host, so that main deploys to your live site.
  4. Turn on Dependabot alerts and security updates.
  5. Make bigger changes on a branch, check the preview link, then merge.

Sources