Search results for: Security

Saying thanks is now a core part of the Security Advisory workflow.

GitHub has scanned public repositories for secrets (like API keys and tokens) for several years. Secret scanning protects our partners and our customers from unauthorized use of the services protected by those…

At GitHub Satellite, we announced code scanning, part of GitHub Advanced Security. Code scanning is a developer-first static application security testing (SAST) product that is built into GitHub. Once configured, it scans…

The repository security tab now includes two new experiences to help you better understand your repository’s security at a glance. First, we have added a counter which makes it easy…

Learn more about the Bug Bounty program, including a recap of 2019’s bugs, our expanded scope, new features, and more.

Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we’ll take a deep-dive in the remediation of a security vulnerability with CERT.

Late last year, we updated Security Advisories to enable you to edit published advisories with new or updated information (like a newly-fixed version or additional impact information). Now, you can…

LGTM Enterprise is a feature of GitHub Advanced Security, and the latest release is now available for download. The 1.23.1 release includes minor feature improvements and fixes non-security bugs. Learn…

You can now edit GitHub Security Advisories after you publish them. This can be helpful if you’ve learned more about the scope or impact of the vulnerability you’re announcing, if…

This is the third post in a series about Ubuntu’s crash reporting system. We’ll review CVE-2019-15790, a vulnerability in apport that enables a local attacker to obtain the ASLR offsets for any process they can start (or restart).

This is the second post in our series about Ubuntu’s crash reporting system. We’ll review CVE-2019-7307, a TOCTOU vulnerability that enables a local attacker to include the contents of any file on the system in a crash report.

Learn more about what’s behind the scenes with GitHub vulnerability alerts.

Keep GitHub Enterprise Server secure with our recommendations for security best practices, from password protection to logging and auditing.

GitHub Security Advisories, which launched in beta earlier this year, are now generally available. And we’ve made some exciting changes based on feedback from maintainers. First, we’ve added the ability…

Automated security updates (formerly Dependabot and automated security fixes) are now generally available in all public repositories on GitHub. After a popular debut at Satellite 2019, more than 3.5 million…

On Day Two of GitHub Universe 2019, we announced GitHub Security Lab to bring together security researchers, maintainers, and companies across the industry who share our belief that the security of open source is important for everyone.

GitHub Security Lab, launched at GitHub Universe 2019, is a new GitHub initiative whose mission is to inspire and enable the community to secure the open source software we all…

GitHub has updated the default security alert email setting to be a single email which details the impact of a new vulnerability across all of your repositories. Previously, for a…

GitHub now supports the WebAuthn standard for authentication. A broad array of security keys can be used across most major browsers (Apple will add support in Fall 2019). The following…

The WebAuthn standard for security keys is making authentication as easy as possible. Now you can use security keys for second-factor authentication on GitHub with many more browsers and devices.

Liran Tal, Developer Advocate at Snyk, shared a few key takeaways and advice from their 2019 Open Source Security Report.