Search results for: Security

Secret scanning is adding validity check support for several additional secret types across multiple providers. In addition to previously announced validators, GitHub is adding validity check support for the following…

When a chat conversation is poisoned by indirect prompt injection, it can result in the exposure of GitHub tokens, confidential files, or even the execution of arbitrary code without the user’s explicit consent. In this blog post, we’ll explain which VS Code features may reduce these risks.

Learn Model Context Protocol by building a turn-based game server that shows how to extend GitHub Copilot with custom tools, resources, and prompts.

See what’s happening at Universe 2025, from experimental dev tools and career coaching to community-powered spaces. Save $400 on your pass with Early Bird pricing.

Now generally available, GitHub Secret Protection users have the ability to configure which secret scanning patterns are included in push protection. This customization helps you to better meet your organization’s…

Dependabot can now automatically update your Rust toolchain versions defined in rust-toolchain.toml and rust-toolchain files, helping you keep your Rust projects up-to-date with the latest stable, beta, or nightly releases.…

GitHub Actions is powered by a diverse ecosystem of first-party and community contributed actions. If one of these actions has a vulnerability or is compromised by a malicious actor, it…

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.22.2 and 2.22.3, which expand Rust support,…

Discover the latest trends and insights on public software development activity on GitHub with the quarterly release of data for the Innovation Graph, updated through March 2025.

The remote GitHub MCP server now scans all of its tool call inputs in public repositories. If an exposed secret is detected, the call is blocked by default with clear…

Learn how the International Telecommunication Union made the switch to open source, and how you can too!

Secret scanning is adding validity check support for 12 additional token types across 11 providers. In addition to previously announced token types, you will now see validity checks for the…

Dependabot now supports automatic dependency updates for vcpkg, the free C/C++ package manager from Microsoft. This enables teams using vcpkg to keep their C and C++ dependencies secure and up-to-date…

Learn how the GitHub Secure Open Source Fund helped 71 open source projects significantly improve their security posture through direct funding, expert guidance, and actionable playbooks.

tl;dr: I am stepping down as GitHub CEO to build my next adventure. GitHub is thriving and has a bright future ahead. The following is the internal post I sent to GitHub employees (Hubbers) this morning announcing my departure.

GitHub continually updates the default pattern set for secret scanning with new patterns and upgrades to existing patterns, helping ensure your repositories have comprehensive detection for different secret types. The…

Learn how to integrate AI features with GitHub Models directly in GitHub Actions workflows.

As of today, npm trusted publishing with OpenID Connect (OIDC) is now generally available. This feature enables you to securely publish npm packages directly from CI/CD workflows using OpenID Connect…

Upgrade from a local MCP Docker image to GitHub’s hosted server and automate pull requests, continuous integration, and security triage in minutes — no tokens required.

On July 28, 2025 21:41 UTC, GitHub Enterprise Importer (GEI) was identified as being in a degraded state with migrations stalled. An incident was declared to restore the service to…

What’s new You can now dismiss or reopen multiple Dependabot alerts at once across your entire organization, making alert management more efficient for security and development teams. Previously, organization-level alert…