Search results for: GitHub Actions

Enhancements to Audit Log Exports

Secret scanning alerts now have a timeline and users can add a comment when resolving

As the home for developers, we understand the key role our communities play in steering digital transformation and maintaining societal infrastructure. That’s why we choose to drive and support policies and initiatives like the Copenhagen Pledge on Tech for Democracy. We’re committed to working with like-minded organizations, governments, and civil society to make digital technologies work for democracy and human rights, and we encourage you to join us in this pledge.

New Audit Log events and event context

We’re reporting on a six-month period rather than annually to increase our level of transparency. For this report, we’ve continued with the more granular reporting we began in our 2021 reports.

Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.

In this post I’ll exploit CVE-2022-1134, a type confusion in Chrome that I reported in March 2022, which allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site. I’ll also look at some past vulnerabilities of this type and some implementation details of inline cache in V8, the JavaScript engine of Chrome.

Expand the completeness of your dependency graph by using the dependency submission API, which will create more comprehensive alerts on supply chain vulnerabilities

Dependency graph has a REST API for submitting dependencies detected at build time

Secret scanning push protection bypasses are now shown in the audit log and API

Prebuilding codespaces is generally available

Configure dependency review for vulnerability severity and license type

Discover how GitHub thinks about browser support, look at usage patterns, and learn about the tools we use to make sure our customers are getting the best experience.

Achievements public beta

Secret scanning alert events now in the audit log

With innersource, it’s important to measure both the amount of innersource activity and the quality of the code being created. Here’s how.

We’re taking a look at some of the most common security vulnerabilities and detailing how developers can best protect themselves.

GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.

Codespaces: Scheduled prebuild configurations

Ensuring secure access to your source code is more important than ever. Git Credential Manager helps make that easy.

Secret scanning custom pattern events now in the audit log