Strengthening supply chain security: Preparing for the next malware campaign
Security advice for users and maintainers to help reduce the impact of the next supply chain malware attack.
Home / Blog Search
Search results for: Security
CodeQL 2.23.7 and 2.23.8 add security queries for Go and Rust
CodeQL is the static analysis engine behind GitHub’s Code Scanning and Code Quality products, which find and remediate issues relating to code quality and security. We’ve recently released CodeQL 2.23.7…
GitHub Advanced Security trials now available for more GitHub Enterprise customers
More GitHub Enterprise customers can now start a self-serve GitHub Advanced Security trial to evaluate GitHub Code Security and GitHub Secret Protection. Enterprises that have previously completed a GitHub Advanced…
Dependabot security updates now support uv
Dependabot now supports security alerts and updates for uv. When vulnerabilities are detected in your uv dependencies, Dependabot can automatically open security alerts and pull requests to update to secure…
More accurate Copilot Autofix usage metrics on security overview
We have enhanced the metrics displayed on the security overview dashboard for CodeQL alerts fixed with Copilot autofixes. This improvement specifically refines how we calculate how much of an autofix…
CodeQL 2.23.6 adds Swift 6.2.1 and new C# security queries
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.23.6, which adds support for Swift 6.2.1,…
Your stack, your rules: Introducing custom agents in GitHub Copilot for observability, IaC, and security
Use partner-built Copilot agents to debug, secure, and automate engineering workflows across your terminal, editor, and github.com.
Secret scanning alert assignees, security campaigns are generally available
To help you track and remediate secret scanning alerts more effectively, secret scanning alert assignees and security campaigns are now generally available. What’s new? Notifications: Alert assignees receive email notifications…
How GitHub’s agentic security principles make our AI agents as secure as possible
Learn more about the agentic security principles that we use to build secure AI products—and how you can apply them to your own agents.
npm security update: Classic token creation disabled and granular token changes
Editor’s note (November 5, 2025): We’ve updated this post to explicitly clarify that the affected tokens are npm tokens. Today marks another milestone in our ongoing effort to strengthen npm’s…
Copilot coding agent now automatically validates code security and quality
GitHub Copilot coding agent is GitHub’s asynchronous, autonomous developer agent that helps your teams move faster by allowing you to delegate a wide range of tasks to it, including implementing…
Top security researcher shares their bug bounty process
For this year’s Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to put the spotlight on a talented security researcher—André Storfjord Kristiansen!
How a top bug bounty researcher got their start in security
For this year’s Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to feature another spotlight on a talented security researcher — @xiridium!
Strengthening npm security: Important changes to authentication and token management
As part of our ongoing commitment to securing the npm ecosystem, we’re implementing the first phase of security improvements outlined in our recent announcement. These changes will roll out over…
Kicking off Cybersecurity Awareness Month 2025: Researcher spotlights and enhanced incentives
For this year’s Cybersecurity Awareness Month, GitHub’s Bug Bounty team is excited to offer some additional incentives to security researchers!
Accelerate remediation with security campaigns and assignable alerts for code scanning and secret scanning
Today, we’re announcing two major enhancements that help security and developer teams remediate security debt more efficiently. Security campaigns for secret scanning alerts Security campaigns are already generally available for…
Incremental security analysis with CodeQL is now available for all languages
CodeQL scans on pull requests for Go, C#, C/C++ and Swift are now incremental. All CodeQL languages now support incremental analysis. This is powered by our new incremental analysis, which…
Post-quantum security for SSH access on GitHub
GitHub is introducing post-quantum secure key exchange methods for SSH access to better protect Git data in transit.
Security contact for security notification emails is generally available
Enterprise admins can now designate a specific contact email for security incident notifications by navigating to Settings > Profile in their enterprise account. This optional field allows for targeted security…
CodeQL 2.23.0 adds support for Rust log injection and other security detection improvements
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.23.0, which introduces a new Rust security…
Improved notifications in security campaigns
Starting today, developers with write access to repositories in security campaigns will receive email notifications without needing to subscribe to repository activity. Previously, users needed to subscribe to All activity…
The world's largest developer platform
GitHub
Build what’s next on GitHub, the place for anyone from anywhere to build anything.
The GitHub Podcast
Catch up on the GitHub podcast, a show dedicated to the topics, trends, stories and culture in and around the open source developer community on GitHub.