This is amazing. Use a SAST to detect security issues, and then triage those alerts with LLMs, to remove false positives and focus on real and exploitable issues. And of course, the framework is open source.

🚀 GitHub is making Actions more secure by default We recently announced upcoming changes to the pull_request_target event and environment protection rules to make GitHub Actions more secure by default. We’ve opened a discussion to gather feedback 👇 🔗 github.com/orgs/communi...

The internet was on fire. 🔥 One small library affecting billions of systems. Log4Shell was the biggest security vulnerability of all time. Now, Log4J maintainer, Christian Grobmeier tells us what it felt like inside the flames 👉 github.blog/open-source/...

“Ignorance will break all software.” Log4Shell’s one line of code broke the internet, and taught us all a lesson we can’t ignore. As Christian Grobmeier, maintainer of Log4J puts it: "Learning is the only cure for ignorance. So just keep learning."

😭

We're taking action to make the npm supply chain stronger and harder to attack. 🛡️ Check out our plan to create a more secure future for the JavaScript community.👇 https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

Recent account takeovers and attacks on package registries are a wake-up call: it's time to raise the bar on authentication and secure publishing practices. Find out what npm is doing—and what steps you can take—to help secure the open source supply chain: github.blog/security/sup...

RIP Graham Greene.

Hey security people, if you’re in Las Vegas, say hi! If you want to talk open source security, or GitHub security products, I’d be happy to chat!

Are you at Security BSides Las Vegas? Our very own Madison Oliver is joining a panel on the evolving role of the CVE Program — from funding challenges to global coordination and new governance models. ℹ️ pretalx.com/security-bsi... 🗓️ August 5 | ⏰ 13:00–13:45 PT

Anyone else going to #ossna and flight to Denver is delayed, without visibility?

If you, a business, are reliant on an open source project to function it is YOUR responsibility to assess and ensure the health of that project by either contributing to it yourself or by using an alternative if project health cannot be guaranteed.

It’s free. It’s fun. It’s easy. Learn about secure coding with the GitHub secure code game.

Is your open source project built on a foundation of trust and security? 🛡️ Strengthen its future with essential practices like MFA, code scanning, safe dependency management, and private vulnerability reporting. 🔐 Learn how to implement these to protect your project and users with this guide. ⬇️

Season 3 of the GitHub Secure Code Game is coming — AI enters the chat 🤖🔥 Catchup with Season 1 and 2 at gh.io/secure-code-game

Star Wars has released one hour of Mon Mothma dancing. #Andor www.youtube.com/watch?v=y6wL...

Finally watched the first episode of The Studio. OMG this is hilarious. I must admit I had a hard time with the disrespect of my hero Marty … I’ll get over it, but it was a difficult moment.

So … Heat or Tombstone tonight? 😢 RIP Val Kilmer

In this demonstration I show the impact of CVE-2025-25291/CVE-2025-25292, an authentication bypass in ruby-saml used by high profile OSS projects such as GitLab. My team coordinated with both the ruby-saml maintainer and GitLab to get this vulnerability fixed and patches are available at gh.io/glfx

Happy Friday folks! Here is a throwback to our 2nd most popular research post of 2024, "Gaining kernel code execution on an MTE-enabled Pixel 8" by Man yue Mo github.blog/security/vul...

Sure, chocolates are nice and all but why not show your favourite open source projects how much you love them by sponsoring them today! github.blog/open-source/...

Don’t just say DEI as if it’s a bad word. Spell it out. Say diversity, which is the lifeblood of American society & culture & innovation. Say equity, which a just society should pursue. Say inclusion, because decent people believe in increasing belonging, not isolating people who are different.

Security researchers are digital detectives, safeguarding the internet by uncovering vulnerabilities. 🔍 Start your journey in cybersecurity research today. ⬇️ github.blog/security/vul...

Hello from the GitHub Security Lab! We are a team of security experts who cultivate a collaborative community where developers and security professionals come together to secure open source software.

768 CVEs Exploited in the Wild in 2024

Jacques Audiard is a genius, Zoe Saldana is a queen. #emilaperez

Prepare to take flight 👀

Excited to see Ecosyste.ms data guiding funding with the launch of Ecosystem Funds! This helps support critical open source projects that often fly under the radar. Congrats to Open Source Collective & Ecosyste.ms on the launch! 🎉 opencollective.com/opensource/u... #OpenSource #Funding

Just watched Possession (A. Zulawski, 1983) for the first time. What a shock! It hurts, almost physically. Adjani’s acting is out of this world.

Achtung Freunde - GitHub is expanding our DevRel team, and we'd love to hire an amazing Senior Developer Advocate based out of Munich, Germany! If you know someone who would be perfect, please share this with them! #jobs #hiring githubinc.jibeapply.com/jobs/3760

Saw Wicked with the family, and everyone loved it! Cynthia and Ariana are soooo good!

We (French) are so lucky! The new us ambassador in France is Trump’s son-in-law’s father, also a convicted felon, with no background in diplomacy! Yay! www.bfmtv.com/internationa...

Watching « Dream scenario ». We need more Nicolas Cage in all the movies!

A new initiative to help open source projects be more secure, with funds from partners and training from the GitHub Security Lab and other experts t.co/oshXlcwdmX

Finished « the penguin ». Great show! Great actors, tight writing.

Just came back from the #ekoparty conference in Argentina. It was great to meet this great #infosec community! See you next year!