GitHub Security Lab

Inspiring lessons from DataJourneyHQ ! Tools are setting a baseline, what matters is to turn security into a habit. 👏🏾 You can set the baseline for your open source project, the Security Lab gets you covered with that: install and run gh.io/gh-secure and you’ll be set in 2 minutes. And you’ll be ready for the next step, which is to include security in your routine!

Extract from Blog Post @ https://lnkd.in/eK-2v-zT 📢 Cucumber participated in the Session 4 of the GitHub Secure Open Source Fund, a program that brought together 50 open source projects across to level up security practices 🔒 For me personally, one big appeal or "pull-factor" was the chance to meet with over 70 maintainers who all are dealing with the same problems as all of us are in OSS. What niggles do they have? How do they manage their projects? How do they all try to keep us safe? Naturally the GitHub Secure Open Source Fund was also there to showcase the latest and greatest developments from GitHub - and on this point, it **did not** disappoint. We were able to utilise things like CodeQL and secret scanning to automate the generation of fixes across over 130 repositories - beyond these automated configurations and fixes, we've also made other notable changes: ✅ Workflows: SHA pinning and minimal permissions ✅ Process: Incident Response Plan, SBOM's and documented procedural changes ✅ Upskilling: How to look for vulnerabilities - special thanks to the GitHub Security Lab -> https://lnkd.in/eEaacCjG for this! So... what's next? Well if anything, it would simply be more of the same. A special thankyou from Cucumber goes out to GitHub, the entire GitHub Security Lab team - who delivered some awesome dedicated specific seminars showcasing a wide variety of attack patterns as well as Microsoft for Startups for helping provide us with Azure credits. Cucumber is now more secure thanks to the GitHub Secure Open Source Fund 🚀 #github #sosf #opensource #oss #cucumber

"AI security is not evolving in isolation. It is becoming part of the broader practice of building secure software. As that shift continues, maintainers will need practical education, trusted communities, and expert support that can evolve with them." Read the latest report from the GitHub Secure Open Source Fund on the learnings from Session 4 –and results from all past sessions. The training curriculum curated with ❤️ by the Security Lab, and created and delivered by experts from GitHub and from partners like OpenSSF is supporting maintainers in this fast changing AI landscape. If you're an OSS maintainer, apply for session 5! https://lnkd.in/eDzvmS7Y

Dependabot and GitHub will now alert you if you use a malicious dependency across most package ecosystems. Read from Senior Engineering Manager Ankit Kumar Honey how they wired OpenSSF’s malicious-packages data into the Advisory Database, and why they built the pipeline paranoid. https://lnkd.in/exMJrTwm

🔐 Attending USENIX in Baltimore? Join Zach Steindler tomorrow for: Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next Learn practical steps to secure builds, prepare incident-response playbooks, track dependencies, and detect compromised packages. 📅 August 13, 2026 🕟 4:30 PM 📍 Baltimore, MD #USENIX #OpenSourceSecurity #SupplyChainSecurity

Hello Security researchers! Here are GitHub's July bug bounty stats! 💪 🐛 530 bounty reports submitted 👥 284 hackers participated in our program 💰 Awarded $267,652 in bounties Found a vulnerability? Submit it here: https://bounty.github.com Heading to DefCon? Come find us, details here: https://lnkd.in/egHwy3FY

Do you want to help secure open source? The GitHub Security Lab hires a Staff Developer Advocate!

Malicious package releases are one of the fastest-moving supply chain threats and automated dependency updates can pick up a malicious package release before maintainers and security researchers have time to catch it. We made a three-day cooldown the default for Dependabot version updates to give new releases a little more time for review before Dependabot opens a pull request. Security updates still open immediately, and if you want, you can adjust the cooldown to fit your project. Read more here: https://lnkd.in/gqC957Yx A big thank you to Jamie Tanna and the Renovate team, Nicky Ringland, Elitsa Bankova, Xueqin Cui and the Google Open Source team for sharing their expertise and ideas. In addition to being awesome people they write awesome content, and you can read about all of our approaches here - Renovate: https://lnkd.in/gwN6wa7n GOSSIP: https://lnkd.in/gZiApJU6 And of course, it wouldn't be possible without the folks at GitHub who helped build this feature: Ankit Kumar Honey, Trevor Rosen, Zach Steindler, Robert Aiken, Marcelo Oliveira, Aaron Cathcart, Xavier René-Corail, Colten Woo 🔒

Hey bounty hunters! GitHub updates its bug bounty program to improve how the company partners with the security research community. The new structure is designed to reduce ambiguity, prioritize the areas of highest risk, and improve the speed and quality of security outcomes. By aligning incentives more closely with impactful findings and streamlining triage, GitHub is reinforcing a security strategy built on transparency, collaboration, and continuous improvement. https://lnkd.in/etE7DZzB