GitHub Security Lab

A new secure default for GitHub Actions: For public repositories that do not already have an applicable event policy, GitHub is introducing a default rule that disables pull_request_target. Vulnerabilities in pull_request_target workflows are ones of the most commonly exploited vulnerabilities in action workflows. It initially runs in evaluate mode, so you can see which workflow runs would be affected before enforcement begins on November 2nd.

If you could secure your open source GitHub repo in less than 60 seconds, would you do it? Even the best open source repos face the following risks: 🚨 Malware pushed to your branches 📣 Unfixed vulnerabilities disclosed to the public 🔓 Leaked credentials 📦 Vulnerable dependencies 🐛 Security bugs in your code We recently wrote a guidance about the 6 security settings every GitHub maintainer should enable to mitigate those risks: https://lnkd.in/ec6DJQCJ That was so early 2026! Now you can get it done with one command. 🚀 Introducing gh secure One command. Free. No security expertise required. gh.io/gh-secure Raise your repository’s security baseline now: gh extension install GitHubSecurityLab/gh-secure gh secure --yes Learn more: https://gh.io/gh-secure

We're in! With sustainable and predictable recurring revenue, package registries can invest more in security capabilities –Artifact signing, trusted publishing, malware scanning and quarantine, build provenance attestations, SBOM and VEX generation, threat detection and incident response SLAs– that will make open source a safer place, for everyone!

Here are the GitHub August bug bounty stats! 🐛 497 bounty reports submitted 👥 222 hackers participated in our program 💰 Awarded $104,402 in bounties Found a vulnerability? Submit it here: https://bounty.github.com

“Peter ignored me, so I was like, how else can I get his attention? Security.” 🔐 Sometimes the best path into open source is finding where your security expertise can help—and being ready to keep learning. Meet the maintainers building and securing OpenClaw: gh.io/openclaw-interview #OpenSourceSecurity

Inspiring lessons from DataJourneyHQ ! Tools are setting a baseline, what matters is to turn security into a habit. 👏🏾 You can set the baseline for your open source project, the Security Lab gets you covered with that: install and run gh.io/gh-secure and you’ll be set in 2 minutes. And you’ll be ready for the next step, which is to include security in your routine!

Extract from Blog Post @ https://lnkd.in/eK-2v-zT 📢 Cucumber participated in the Session 4 of the GitHub Secure Open Source Fund, a program that brought together 50 open source projects across to level up security practices 🔒 For me personally, one big appeal or "pull-factor" was the chance to meet with over 70 maintainers who all are dealing with the same problems as all of us are in OSS. What niggles do they have? How do they manage their projects? How do they all try to keep us safe? Naturally the GitHub Secure Open Source Fund was also there to showcase the latest and greatest developments from GitHub - and on this point, it **did not** disappoint. We were able to utilise things like CodeQL and secret scanning to automate the generation of fixes across over 130 repositories - beyond these automated configurations and fixes, we've also made other notable changes: ✅ Workflows: SHA pinning and minimal permissions ✅ Process: Incident Response Plan, SBOM's and documented procedural changes ✅ Upskilling: How to look for vulnerabilities - special thanks to the GitHub Security Lab -> https://lnkd.in/eEaacCjG for this! So... what's next? Well if anything, it would simply be more of the same. A special thankyou from Cucumber goes out to GitHub, the entire GitHub Security Lab team - who delivered some awesome dedicated specific seminars showcasing a wide variety of attack patterns as well as Microsoft for Startups for helping provide us with Azure credits. Cucumber is now more secure thanks to the GitHub Secure Open Source Fund 🚀 #github #sosf #opensource #oss #cucumber

"AI security is not evolving in isolation. It is becoming part of the broader practice of building secure software. As that shift continues, maintainers will need practical education, trusted communities, and expert support that can evolve with them." Read the latest report from the GitHub Secure Open Source Fund on the learnings from Session 4 –and results from all past sessions. The training curriculum curated with ❤️ by the Security Lab, and created and delivered by experts from GitHub and from partners like OpenSSF is supporting maintainers in this fast changing AI landscape. If you're an OSS maintainer, apply for session 5! https://lnkd.in/eDzvmS7Y

Dependabot and GitHub will now alert you if you use a malicious dependency across most package ecosystems. Read from Senior Engineering Manager Ankit Kumar Honey how they wired OpenSSF’s malicious-packages data into the Advisory Database, and why they built the pipeline paranoid. https://lnkd.in/exMJrTwm