Learn how we triage security alerts in GitHub Actions and JavaScript projects with the new GitHub Security Lab Taskflow Agent, and leverage LLM to focus on the exploitable vulnerabilities. github.blog/security/ai-...

Excited to share our open source agentic framework for security research, a collaborative framework that lets the community share AI "taskflows”! Read @kevinbackhouse.bsky.social 's blog post for details and a demo. Join us in strengthening open-source security! github.blog/security/com...

We wrapped up 2025 on a high note—here are the bug bounty stats for December! ✅ 151 bounty reports submitted 👥110 hackers participated in our program 💰Awarded $48,367 in bounties Found a vulnerability? Submit it here: bounty.github.com.

Learn why some vulnerabilities resist to fuzzing and persist in long-enrolled OSS-Fuzz projects, and how you can find them! github.blog/security/vul...

In just 17 minutes, @yarlob.bsky.social shares his knowledge about securing GitHub Actions, drawing from hands-on experience uncovering hundreds of real-world vulnerabilities. The talk wraps up with FREE tools to automate GitHub Actions security you can start using TODAY. gh.io/secure-githu...

GitHub Security Lab discovered a critical vulnerability in WooCommerce. We’d like to thank WooCommerce/Automattic for their incredibly quick response and fix of the vulnerability. If you are using WooCommerce, please update. For more info see: developer.woocommerce.com/2025/12/22/s...

Hello Hackers! Here are our November bug bounty stats! 🐛146 bounty reports submitted 👩‍💻102 hackers participated in our program 💰Awarded $93,068 in bounties Found a vulnerability? Submit it here: bounty.github.com

Attending AI Native DevCon? Join @jkcso.bsky.social and discover practical ways to use AI for security through 14 live GitHub Copilot demos from secure coding, to supply chain decisions, to MCP servers. 📅 November 19, 11:40 AM EST 📍 Industry City, Kings County, NY + online 👉 ainativedev.io/devcon

Join us at @nerdearla.bsky.social to discover how GitHub secures the open source software we rely on. From security research and education to free tools and programs that have strengthened the security of hundreds of projects. 📅 November 14, 11 AM CET 📍 LaNaveMadrid + free streaming 👉 nerdearla.es

🚀 GitHub is making Actions more secure by default We recently announced upcoming changes to the pull_request_target event and environment protection rules to make GitHub Actions more secure by default. We’ve opened a discussion to gather feedback 👇 🔗 github.com/orgs/communi...

Here are our October bug bounty stats! 🐛 162 bounty reports submitted 🎃 121 hackers participated in our program 💰 Awarded $78,968 in bounties Found a vulnerability? Submit it here: bounty.github.com

Building with AI? 🤖 Then you won’t want to miss tomorrow’s #GitHubUniverse workshop with Joseph Katsioloudes and Rahul Zhade — all about how to build secure LLM-powered applications. 📍 Fort Mason Center for Arts & Culture 🗓️ Oct 29, 1:15–2:45 PM PDT

🎉 It’s Friday at #EkoParty! Join us at the GitHub booth at 15:30 for the GitHub Quiz 🧠 Test your security knowledge, win exclusive GitHub swag, grab some stickers, and chat with our experts! 👉 gh.io/eko

Aprende como usar LLMs para mejorar el proceso de fuzzing en la charla de Antonio Morales en #ekoparty2025 📅 Jueves, 23 Oct, 15:30 AST

👋 Hola Argentina! We’re thrilled to be at #EkoParty this week! If you’re around, swing by the GitHub booth — grab some stickers, play our security games, and chat with our experts about all things open source & security. See you there 👉 gh.io/eko

The internet was on fire. 🔥 One small library affecting billions of systems. Log4Shell was the biggest security vulnerability of all time. Now, Log4J maintainer, Christian Grobmeier tells us what it felt like inside the flames 👉 github.blog/open-source/...

Are you in Warsaw for The Hack Summit Warsaw? Join Sylwia Budzynska for an introductory talk about security research, static analysis, and CodeQL: "From One Bug to Hundreds: Scaling Vulnerability Research with CodeQL" 📆 October 14, 11:20 CEST Track: Security in Software Development & DevSecOps

Here are our September bug bounty stats! ✅ 166 bounty reports submitted 👥 120 hackers participated in our program 💰 Awarded $113,008 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p.

⏱️ Maintainers, we know you don’t have time to research every security best practice. That’s why we’ve made it simple: ✅ 15 minutes ✅ No security expertise required ✅ Free for open source ✅ Quick wins with long-term impact Protect your project now at gh.io/protect-your-project

Recent account takeovers and attacks on package registries are a wake-up call: it's time to raise the bar on authentication and secure publishing practices. Find out what npm is doing—and what steps you can take—to help secure the open source supply chain: github.blog/security/sup...

Here are our August bug bounty stats! ✅ 173 bounty reports submitted 👥 131 hackers participated in our program 💰 Awarded $28,667 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p.

Georg Semmler, the maintainer of github.com/diesel-rs/di... and one of the recent participants in the GitHub Secure Open Source Fund, has written a tool called cargo-safe-publish that helps protect against supply chain attacks in the Rust Cargo ecosystem. Read more: blog.weiznich.de/blog/cargo-s...

What if attackers could hijack your coding agent through a simple GitHub issue? Prompt injections are a real and growing threat for VS Code Copilot Agent. Learn how these attacks work and how you can defend your environment. Read the full research: github.blog/security/vul...

Join GitHub Open Source Friday - Aug 22, 10am PT - for a special episode featuring Bartosz Gałek and @jkcso.bsky.social, contributors to the Secure Code Game. Discover how Season 3 is empowering developers and students to build safer LLM-based applications. www.linkedin.com/events/73635...

🚀 GitHub is on a mission to supercharge open-source security! We've partnered with 71 key open-source projects, giving them tools, funding, and playbooks to boost security. 🔐 Want your project to be part of this effort? Now’s the time to get involved! 💪 🔗 Find out more: github.blog/open-source/...

Join Madison Oliver at DEF CON as she joins a panel on modernizing the CVE Program to meet the demands of AI-scale discovery, real-time coordination, and global software supply chains. 🗓️ Saturday, August 9 | ⏰ 12:30 PM 📍 Policy Stage | Room 234

Here are our July bug bounty stats! ✅174 bounty reports submitted 👥140 hackers participated in our program 💰 Awarded $103,202 in bounties Found a vulnerability? Submit it here: bounty.github.com.

Are you at Security BSides Las Vegas? Our very own Madison Oliver is joining a panel on the evolving role of the CVE Program — from funding challenges to global coordination and new governance models. ℹ️ pretalx.com/security-bsi... 🗓️ August 5 | ⏰ 13:00–13:45 PT

Meet our team at Black Hat USA 2025 and DEF CON! At Black Hat, find us at booth #4824. Who’s attending: Xavier René-Corail – Senior Director, GitHub Security Lab Kevin Backhouse – Staff Manager, Security Research Madison Oliver – Senior Manager, Security Research Come by and say hi!

GHSL-2025-059_7: Denial of Service (DoS) because of null pointer dereference in 7-Zip - CVE-2025-53817 securitylab.github.com/advisories/G...

GHSL-2025-058_7: Denial of Service (DoS) because of memory corruption in 7-Zip - CVE-2025-53816 securitylab.github.com/advisories/G...

🧠 CORS misconfigurations are sneaky. Want to catch them with static analysis? Kevin Stubbings from GitHub Security Lab shows how to model CORS middleware in CodeQL—using Go’s Gin framework as a case study. Great insights for researchers & devs: github.blog/security/app...

Curious how GitHub helps secure the open source software the world runs on? Join us tomorrow at WeAreDevelopers World Congress 2025 and see it in action. 🕚 July 10, 16:10 CET 📍 Stage 11

New vuln from the GitHub Security Lab 🔍 Antonio + Kev team up to uncover CVE-2025-53367 — an out-of-bounds write in DjVuLibre that could lead to code execution on Linux desktops. Found via fuzzing. 🧠 Read the announcement: github.blog/security/vul...

Here are our June bug bounty stats! ✅ 120 bounty reports submitted 👥 103 hackers participated in our program 💰 Awarded $43,651 in bounties Found a vulnerability? Submit it here: bounty.github.com

Here are our May bug bounty stats! ✅159 bounty reports submitted 👥118 hackers participated in our program 💰 Awarded $47,551 in bounties Found a vulnerability? Submit it here: bounty.github.com

We break down DNS rebinding attacks in our latest blog post. Explore the topic further and see how it can be used to exploit vulnerabilities in the real-world. github.blog/security/app...

Our Advisory Database surpassed 20,000 reviewed security advisories last year! Discover how GitHub's Advisory Database helps prioritize vulnerabilities and address what matters most in our latest blog post. github.blog/security/git...

Train for the future of app security! 🛡️ Dive into the new season of the GitHub Secure Code Game as you go face to face with the security risks introduced by artificial intelligence. 🤖 Ready to level up your security skills? Get to playing. 🎮

We just launched season three of the GitHub Secure Code Game, and this time we’re putting you face to face with the security risks introduced by artificial intelligence. Get ready to learn by doing and have fun doing it! github.blog/security/hac...

Our team member Man Yue Mo is back, showing a new way to bypass MTE protection on Android phones with CVE-2025-0072. github.blog/security/vul...

🚀 Want to secure your code like a pro? Join us virtually to explore how developers can use #AI and #GitHubCopilot to build secure software—faster and smarter! 🕚 May 22, 10am GMT 📍 Online (FREE & LIVE!) 🔗 Save your spot now and forward to your peers: developer.microsoft.com/en-us/reacto...

This What’s in the SOSS? podcast is a special #MaintainerMonth episode featuring GitHub’s Securing Open Source Software Fund—where training meets funding to help OSS projects scale security. 🎧 openssf.org/podcast/2025... 👉 maintainermonth.github.com/security-cha...

Season 3 of the GitHub Secure Code Game is coming — AI enters the chat 🤖🔥 Catchup with Season 1 and 2 at gh.io/secure-code-game

Here are our April bug bounty stats! ✅ 145 bounty reports submitted 👥 117 hackers participated in our program 💰 Awarded $36,535 in bounties Found a vulnerability? Submit it here: bounty.github.com.

CodeQL analysis is now generally available for your GitHub Actions workflow files! Use automated code scanning and Copilot autofix to detect and remediate vulnerabilities in your CI/CD pipeline. github.blog/changelog/20...

Hello security researchers! Sharing the GitHub March bug bounty stats! 🐛 198 bounty reports submitted 👩‍💻 135 hackers participated in our program 💰 Awarded $62,701 in bounties Found a vulnerability on GitHub? Submit it here: bounty.github.com

In our latest blogpost, learn how to identify which CVE Numbering Authority is responsible for the record, how to contact them, and what to include with your suggestion. github.blog/security/vul...

Are you in Athens for Devoxx Greece? Don't miss @jkcso.bsky.social's talks on the main stage this Thursday and Friday! Discover how AI, Developer Experience (DevEx), and communities shape software security through real-world examples from securely building GitHub using GitHub 🔒

Join us next week at #VulnCon2025 in Raleigh, North Carolina, where we’ll have a strong presence with these exciting sessions 🧵