Security

GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience working with the GitHub team.

The GitHub Advisory Database is processing more vulnerability reports than ever before. Here’s what’s driving the surge, how we’re responding, and how the community can help.

We’re updating our bug bounty program standards to prioritize quality submissions, clarify shared responsibility boundaries, and evolve how we reward low-risk findings.

CodeQL and AI‑powered detections work together in GitHub Code Security to identify vulnerabilities across more languages and frameworks.

Learn more about the agentic security principles that we use to build secure AI products—and how you can apply them to your own agents.

GitHub is introducing post-quantum secure key exchange methods for SSH access to better protect Git data in transit.

When a chat conversation is poisoned by indirect prompt injection, it can result in the exposure of GitHub tokens, confidential files, or even the execution of arbitrary code without the user’s explicit consent. In this blog post, we’ll explain which VS Code features may reduce these risks.

Strengthen your repositories against actions workflow injections — one of the most common vulnerabilities.

Learn how to leverage GitHub Copilot to make your code more secure.

Explore insights into open source community growth, innovation, and inclusivity with an updated survey dataset.

Applications for the new GitHub Secure Open Source Fund are now open! Applications will be reviewed on a rolling basis until they close on January 7 at 11:59 pm PT. Programming and funding will begin in early 2025.

Now in public beta for GitHub Advanced Security customers, code scanning autofix helps developers remediate more than two-thirds of supported alerts with little or no editing.

A peek under the hood of GitHub Advanced Security code scanning autofix.