⏱️ Maintainers, we know you don’t have time to research every security best practice. That’s why we’ve made it simple: ✅ 15 minutes ✅ No security expertise required ✅ Free for open source ✅ Quick wins with long-term impact Protect your project now at gh.io/protect-your-project

Recent account takeovers and attacks on package registries are a wake-up call: it's time to raise the bar on authentication and secure publishing practices. Find out what npm is doing—and what steps you can take—to help secure the open source supply chain: github.blog/security/sup...

Here are our August bug bounty stats! ✅ 173 bounty reports submitted 👥 131 hackers participated in our program 💰 Awarded $28,667 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p.

Georg Semmler, the maintainer of github.com/diesel-rs/di... and one of the recent participants in the GitHub Secure Open Source Fund, has written a tool called cargo-safe-publish that helps protect against supply chain attacks in the Rust Cargo ecosystem. Read more: blog.weiznich.de/blog/cargo-s...

What if attackers could hijack your coding agent through a simple GitHub issue? Prompt injections are a real and growing threat for VS Code Copilot Agent. Learn how these attacks work and how you can defend your environment. Read the full research: github.blog/security/vul...

Join GitHub Open Source Friday - Aug 22, 10am PT - for a special episode featuring Bartosz Gałek and @jkcso.bsky.social, contributors to the Secure Code Game. Discover how Season 3 is empowering developers and students to build safer LLM-based applications. www.linkedin.com/events/73635...

🚀 GitHub is on a mission to supercharge open-source security! We've partnered with 71 key open-source projects, giving them tools, funding, and playbooks to boost security. 🔐 Want your project to be part of this effort? Now’s the time to get involved! 💪 🔗 Find out more: github.blog/open-source/...

Join Madison Oliver at DEF CON as she joins a panel on modernizing the CVE Program to meet the demands of AI-scale discovery, real-time coordination, and global software supply chains. 🗓️ Saturday, August 9 | ⏰ 12:30 PM 📍 Policy Stage | Room 234

Here are our July bug bounty stats! ✅174 bounty reports submitted 👥140 hackers participated in our program 💰 Awarded $103,202 in bounties Found a vulnerability? Submit it here: bounty.github.com.

Are you at Security BSides Las Vegas? Our very own Madison Oliver is joining a panel on the evolving role of the CVE Program — from funding challenges to global coordination and new governance models. ℹ️ pretalx.com/security-bsi... 🗓️ August 5 | ⏰ 13:00–13:45 PT

Meet our team at Black Hat USA 2025 and DEF CON! At Black Hat, find us at booth #4824. Who’s attending: Xavier René-Corail – Senior Director, GitHub Security Lab Kevin Backhouse – Staff Manager, Security Research Madison Oliver – Senior Manager, Security Research Come by and say hi!

GHSL-2025-059_7: Denial of Service (DoS) because of null pointer dereference in 7-Zip - CVE-2025-53817 securitylab.github.com/advisories/G...

GHSL-2025-058_7: Denial of Service (DoS) because of memory corruption in 7-Zip - CVE-2025-53816 securitylab.github.com/advisories/G...

🧠 CORS misconfigurations are sneaky. Want to catch them with static analysis? Kevin Stubbings from GitHub Security Lab shows how to model CORS middleware in CodeQL—using Go’s Gin framework as a case study. Great insights for researchers & devs: github.blog/security/app...

Curious how GitHub helps secure the open source software the world runs on? Join us tomorrow at WeAreDevelopers World Congress 2025 and see it in action. 🕚 July 10, 16:10 CET 📍 Stage 11

New vuln from the GitHub Security Lab 🔍 Antonio + Kev team up to uncover CVE-2025-53367 — an out-of-bounds write in DjVuLibre that could lead to code execution on Linux desktops. Found via fuzzing. 🧠 Read the announcement: github.blog/security/vul...

Here are our June bug bounty stats! ✅ 120 bounty reports submitted 👥 103 hackers participated in our program 💰 Awarded $43,651 in bounties Found a vulnerability? Submit it here: bounty.github.com

Here are our May bug bounty stats! ✅159 bounty reports submitted 👥118 hackers participated in our program 💰 Awarded $47,551 in bounties Found a vulnerability? Submit it here: bounty.github.com

We break down DNS rebinding attacks in our latest blog post. Explore the topic further and see how it can be used to exploit vulnerabilities in the real-world. github.blog/security/app...

Our Advisory Database surpassed 20,000 reviewed security advisories last year! Discover how GitHub's Advisory Database helps prioritize vulnerabilities and address what matters most in our latest blog post. github.blog/security/git...

Train for the future of app security! 🛡️ Dive into the new season of the GitHub Secure Code Game as you go face to face with the security risks introduced by artificial intelligence. 🤖 Ready to level up your security skills? Get to playing. 🎮

We just launched season three of the GitHub Secure Code Game, and this time we’re putting you face to face with the security risks introduced by artificial intelligence. Get ready to learn by doing and have fun doing it! github.blog/security/hac...

Our team member Man Yue Mo is back, showing a new way to bypass MTE protection on Android phones with CVE-2025-0072. github.blog/security/vul...

🚀 Want to secure your code like a pro? Join us virtually to explore how developers can use #AI and #GitHubCopilot to build secure software—faster and smarter! 🕚 May 22, 10am GMT 📍 Online (FREE & LIVE!) 🔗 Save your spot now and forward to your peers: developer.microsoft.com/en-us/reacto...

This What’s in the SOSS? podcast is a special #MaintainerMonth episode featuring GitHub’s Securing Open Source Software Fund—where training meets funding to help OSS projects scale security. 🎧 openssf.org/podcast/2025... 👉 maintainermonth.github.com/security-cha...

Season 3 of the GitHub Secure Code Game is coming — AI enters the chat 🤖🔥 Catchup with Season 1 and 2 at gh.io/secure-code-game

Here are our April bug bounty stats! ✅ 145 bounty reports submitted 👥 117 hackers participated in our program 💰 Awarded $36,535 in bounties Found a vulnerability? Submit it here: bounty.github.com.

CodeQL analysis is now generally available for your GitHub Actions workflow files! Use automated code scanning and Copilot autofix to detect and remediate vulnerabilities in your CI/CD pipeline. github.blog/changelog/20...

Hello security researchers! Sharing the GitHub March bug bounty stats! 🐛 198 bounty reports submitted 👩‍💻 135 hackers participated in our program 💰 Awarded $62,701 in bounties Found a vulnerability on GitHub? Submit it here: bounty.github.com

In our latest blogpost, learn how to identify which CVE Numbering Authority is responsible for the record, how to contact them, and what to include with your suggestion. github.blog/security/vul...

Are you in Athens for Devoxx Greece? Don't miss @jkcso.bsky.social's talks on the main stage this Thursday and Friday! Discover how AI, Developer Experience (DevEx), and communities shape software security through real-world examples from securely building GitHub using GitHub 🔒

Join us next week at #VulnCon2025 in Raleigh, North Carolina, where we’ll have a strong presence with these exciting sessions 🧵

Learn how to set up CORS securely and avoid common pitfalls found in open-source software in our latest blog post! github.blog/security/app...

Open source maintainers, did you receive your first vulnerability report? Don't panic! Handling vulnerability reports doesn’t have to be stressful. Read on to find out how you can tackle security issues efficiently and confidently with the right tools and approach. github.blog/security/vul...

If you are at the Linux Foundation Member Summit, don't miss Madison Oliver @taladrane.bsky.social talking with Brian Fox and CRob about "Consumption Complacency: Bridging the Gap Between Discovery and Remediation", at 2:45

In this demonstration I show the impact of CVE-2025-25291/CVE-2025-25292, an authentication bypass in ruby-saml used by high profile OSS projects such as GitLab. My team coordinated with both the ruby-saml maintainer and GitLab to get this vulnerability fixed and patches are available at gh.io/glfx

In this blog post, we detail newly discovered authentication bypass vulnerabilities in the ruby-saml library used for single sign-on (SSO) via SAML on the service provider (application) side. github.blog/security/sig...

🚀 Calling all CoderGirls in Aarhus! Join @blazingwind.bsky.social for a Code Night at the Microsoft office—a relaxed evening of coding, collaboration, and community. 📅 Thursday, Mar 13, 2025 ⏰ 4:30–6:30PM CET 📍 INCUBA, Åbogade 15, Århus N Bring your laptop, your ideas, and let’s code together! 💻✨

Tomorrow, we are excited to host a software security competition based on gh.io/secure-code-game 🔐 for CyberWeek 2025 at the Microsoft Technology Center in Bellevue, WA. May the more secure win!

Happy Friday folks! Here is a throwback to our 2nd most popular research post of 2024, "Gaining kernel code execution on an MTE-enabled Pixel 8" by Man yue Mo github.blog/security/vul...

Keep your GitHub Actions secure! Vulnerable Workflows can expose you to secrets leaks, repository takeovers, remote code execution on your runners, and more. Read our series on GitHub Actions security to learn more securitylab.github.com/resources/gi...

Time flies! 4 years ago Antonio Morales published his Fuzzing101 online course. 3,000 stars and hundreds of happy learners later, Rumor has it that Antonio is working on some new exercises! So, catch-up now on the first 10 challenges before he drops the new ones at gh.io/fuzzing101 gh.io/fuzzing101!

The Security Lab is proud to sponsor NullCon Goa 2025! We are also funding scholarship tickets to enable and empower the next generation of security researchers to attend these high-quality conference sessions and network with security professionals! Enjoy, folks!

ICYMI Nancy Gariché published an article full of insights and practical tips for those considering starting a career in Cybersecurity: "Cybersecurity researchers: Digital detectives in a connected world" github.blog/security/vul...

Hey 👋🏾 it's the weekend folks! Let's enjoy a throwback to our most popular research post of 2024, "3 ways to get Remote Code Execution in Kafka UI" github.blog/security/vul... by @artsploit.com

Why does GitHub Security Lab do research like Man Yue Mo’s recent work on bypassing MTE on the Pixel 8? This question was asked on Hacker News and we think it’s worth a short thread. news.ycombinator.com/item?id=3975...

Hello from the GitHub Security Lab! We are a team of security experts who cultivate a collaborative community where developers and security professionals come together to secure open source software.