Search results for: GitHub Actions

New Audit Log events and event context

We’re reporting on a six-month period rather than annually to increase our level of transparency. For this report, we’ve continued with the more granular reporting we began in our 2021 reports.

Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.

In this post I’ll exploit CVE-2022-1134, a type confusion in Chrome that I reported in March 2022, which allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site. I’ll also look at some past vulnerabilities of this type and some implementation details of inline cache in V8, the JavaScript engine of Chrome.

Expand the completeness of your dependency graph by using the dependency submission API, which will create more comprehensive alerts on supply chain vulnerabilities

Dependency graph has a REST API for submitting dependencies detected at build time

Secret scanning push protection bypasses are now shown in the audit log and API

Prebuilding codespaces is generally available

Configure dependency review for vulnerability severity and license type

Discover how GitHub thinks about browser support, look at usage patterns, and learn about the tools we use to make sure our customers are getting the best experience.

Achievements public beta

Secret scanning alert events now in the audit log

With innersource, it’s important to measure both the amount of innersource activity and the quality of the code being created. Here’s how.

We’re taking a look at some of the most common security vulnerabilities and detailing how developers can best protect themselves.

GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.

Codespaces: Scheduled prebuild configurations

Ensuring secure access to your source code is more important than ever. Git Credential Manager helps make that easy.

Secret scanning custom pattern events now in the audit log

The new dependency review action and API prevents the introduction of known supply chain vulnerabilities into your code.

Introducing organization moderators

As the global response to the tragedies in Ukraine and other impacted regions continues to evolve, I wanted to share with our community an expansion of the message that I shared earlier this week with our Hubbers.