Application security orchestration with GitHub Advanced Security
Learn how teams can leverage the power of GitHub Advanced Security’s code scanning and GitHub Actions to integrate the right security testing tools at the right time.
Home / You searched for Security / Blog Search
Search results for: Security
Security advisories now have multiple types of credits
You can now designate different types of credits to users who contribute to GitHub security advisories. These new credit types mirror those in the CVE 5.0 schema: finder reporter analyst…
GitHub Security Lab audited DataHub: Here’s what they found
The GitHub Security Lab audited DataHub, an open source metadata platform, and discovered several vulnerabilities in the platform’s authentication and authorization modules. These vulnerabilities could have enabled an attacker to bypass authentication and gain access to sensitive data stored on the platform.
Code scanning default setup on the security coverage page (public beta)
Code scanning default setup can now be easily enabled for a single repository from the slide-out panel on your organization’s “Security Coverage” page, without needing to navigate to the repository’s…
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git apply` or `git clone` against untrusted patches or repositories.
Unlocking security updates for transitive dependencies with npm
How Dependabot integrated with npm to address security vulnerabilities on transitive dependencies and increase the likelihood of success for JavaScript security updates by 40%.
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows.
Security overview’s team filter now includes repositories with write privileges
In security overview, when you select a team from the Team dropdown or filter by team in either the security risk or the security coverage views, results include repositories where…
Code security enablement settings on the list organization repositories REST API
You can now view (GET) the security feature enablement status for all repositories in your organization using the “list organization repositories” endpoint in the REST API for the following security…
GitHub Advanced Security customers can now push protect their custom patterns
With just one click, admins in GitHub Advanced Security organizations can protect their custom patterns on push.
Raising the bar for software security: next steps for GitHub.com 2FA
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023. Learn more about our approach, when we’ll begin our rollout, and what you can expect as we begin requiring 2FA.
Improvements to GitHub Advanced Security billing pages
We’ve shipped improvements to the billing pages for GitHub Advanced Security so it is easier for you to see how many licenses you are using. You can now see how…
Organization-level security risk and coverage pages replace overview page
The organization-level security overview page has been replaced by the risk and coverage views as previously announced and is no longer available. The risk view is designed to help you…
Incremental improvements on security advisory form
We’ve recently released a few minor user experience improvements for our GitHub Security Advisory form: You’re no longer required to fill out as many fields in the form before submitting…
Dependabot now supports security updates for Dart and Flutter apps that use Pub packages
Dependabot security updates now supports the Pub ecosystem, making it easier for you to fix vulnerable dependencies in your Dart or Flutter apps. With security updates enabled, Dependabot will automatically…
Dependabot security updates now supports GitHub Actions
Dependabot security updates now supports the GitHub Actions ecosystem, making it easier for you to fix vulnerable GitHub Actions dependencies. With security updates enabled, Dependabot will automatically raise a pull…
Feature enablement from the organization-level security coverage page
You can now enable and disable the following GitHub security features for a single repository from the organization-level security coverage view: Dependency graph Dependabot alerts Dependabot security updates If you…
Risk and coverage views on the Security tab for organizations (public beta)
Security overview’s new risk and coverage views provide greater visibility into your security posture and risk analysis. Each new view offers a refreshed design with several key improvements, including insights…
The importance of improving supply chain security in open source
We think a lot about a high-profile supply chain attack that might cause developers, teams, and organizations to lose trust in open source. That’s why we’re investing in new ways to protect the open source ecosystem.
Security policy highlighted on repository overview
A Security.md file in the root of a repository will now be highlighted on the repository overview in the sidebar. For more information, see “Adding a security policy to your…
Creating a more inclusive security research field
A glimpse into the backgrounds and day-to-day work of several GitHub employees in cybersecurity roles.
The world's largest developer platform
GitHub
Build what’s next on GitHub, the place for anyone from anywhere to build anything.
The GitHub Podcast
Catch up on the GitHub podcast, a show dedicated to the topics, trends, stories and culture in and around the open source developer community on GitHub.