Automated security updates (formerly Dependabot and automated security fixes) are now generally available in all public repositories on GitHub. After a popular debut at Satellite 2019, more than 3.5 million active repositories have the feature enabled and receive automated pull requests that update them to the nearest non-vulnerable dependency versions. Thanks to all of our beta testers and Dependabot users for your feedback and support.
GoCardless, HashiCorp, Postman, and Tencent Cloud join our token scanning program
Token leaks are one of the most common security mistakes, and they can have disastrous consequences. GitHub Token Scanning looks for leaked tokens in public repositories and works with the issuer to notify the developer and/or revoke the token as appropriate. This protects users from fraud or data leaks. Starting today, GitHub has partnered with GoCardless, HashiCorp, Postman, and Tencent Cloud to scan for their respective developer tokens.
Learn more about token scanning
Partnering with GitHub on token scanning
GitHub Security Lab, launched at GitHub Universe 2019, is a new GitHub initiative whose mission is to inspire and enable the community to secure the open source software we all depend on. We hunt for vulnerabilities in open source projects and build tools to make it easier for others to find those vulnerabilities in their own codebases. In addition, we’re building an open coalition with security teams and researchers across the world that will focus on making security accessible to every researcher and every developer.
GitHub’s first contribution to the Security Lab effort is the free release of CodeQL for Research. CodeQL is an industry-leading semantic code analysis engine that enables you to discover vulnerabilities across your codebase. You can query code as though it were data to find a vulnerability pattern and all of its variants.