GitHub

Maintainers: You don’t need to be a security engineer to improve your project’s security. Enable these 6 free GitHub settings in under 30 minutes. 1. Add a SECURITY .md file Explain how to report vulnerabilities privately, what is in scope, and what information reporters should provide. 2. Enable private vulnerability reporting Give researchers a confidential place to submit reports so you can triage, fix, and disclose vulnerabilities on an appropriate timeline. 3. Turn on secret scanning with push protection Detect exposed credentials and help prevent API keys and tokens from entering your repository in the first place. 4. Enable Dependabot and dependency review Get alerts about vulnerable packages and review the security impact of dependency changes inside pull requests. 5. Turn on code scanning Use CodeQL to identify patterns associated with vulnerabilities, including injection flaws, unsafe deserialization, and insecure GitHub Actions workflows. 6. Protect your default branch Require pull requests and at least one approval before merging. This helps prevent risky direct pushes and ensures security checks have a chance to work. These settings won’t make your project unhackable. Nothing will. But they make automated attacks significantly harder for your project, its users, and everything that depends on it. https://lnkd.in/ec6DJQCJ

Save this for the next time you need to compare diffs. 💡

What does it take for a government to adopt open source sustainably and at scale? As Ghana advances an ambitious digital reset, the GitHub Policy team partnered with the United Nations Development Programme to conduct an Open Source Programme Office Readiness Assessment (OSPORA). The findings reveal strong political commitment, experienced champions, and a fast-growing technology community, while also highlighting opportunities to strengthen policy, cross-ministry coordination, and internal capacity. Ghana’s experience shows how open source governance can advance digital sovereignty, local innovation, and sustainable public services. 🌍 https://lnkd.in/eDSDjgZr

Meet your control center for agentic development. The GitHub Copilot app is now generally available on macOS, Windows, and Linux. Watch how Git worktrees and agent merge help you run parallel workflows safely and efficiently. Download the Copilot app 👇 https://lnkd.in/eBeT6YwB

This Rubber Duck Thursday, Brad Groux (CEO of DigitalMeld, Microsoft maintainer on OpenClaw) joins us to dig into where a lot of the real AI opportunity actually is, outside the usual software circles. We’ll look at blue-collar businesses running on scheduling challenges, invoices, and follow-ups that still power most of the economy. Then we’ll break down what agent systems look like when they leave demos and enter real workflows, and why users don’t care about your stack if Thursday’s jobs never make it onto the calendar.

Join us live as we try out the new GPT-5.6 models (Luna, Terra, Sol) in the GitHub Copilot App.

My GitHub beginner tip: always ________. Fill in the blank. 💡 We've put all of our GitHub for Beginners guides into one roadmap for anyone still filling in that blank. Bookmark this, or share with a friend who's just getting started 👇 https://lnkd.in/espen3Bu

GitHub Copilot for Atlassian's Jira is now generally available. With Copilot in Jira, you can: • stream agent progress to Jira • provide follow-up instructions directly in the Jira chat panel • connect your GitHub org and repos to the Jira app faster with fewer steps at the point of setup Learn more about the new capabilities 💡 https://lnkd.in/ekQcGAE6