Security

Resources for securing your supply chain, building more secure applications, and staying up-to-date with the latest vulnerability research. Get comprehensive insights into the latest security trends, vulnerabilities, and best practices to safeguard software projects—and news from the GitHub Security Lab. Learn about various aspects of application security, such as threat modeling, secure coding techniques, vulnerability assessments, and the importance of regular security testing.

Also, learn more about the tools and features available on GitHub to help manage and improve the security of your codebases. This includes information on GitHub’s security alerts, code scanning, secret scanning, and dependency management features, which are designed to detect and mitigate vulnerabilities early in the development process. And if you want to get more technical, you can head over to our documentation on code security on GitHub to find out how to keep your code and applications safe.

Security

A smarter, quieter Dependabot

Dependabot is getting a little smarter—and, a little quieter—by reducing bot-based noise from repositories based on your interaction with Dependabot.

Security

GitHub and the Ekoparty 2022 Capture the Flag

Learn about the design behind, and solutions to, several of GitHub’s CTF challenge for Ekoparty’s 2022 event!

Application security

Leaked a secret? Check your GitHub alerts…for free

GitHub now allows you to track any leaked secrets in your public repository, for free. With secret scanning alerts, you can track and action on leaked secrets directly within GitHub.

Application security

How empowering developers helps teams ship secure software faster

AppSec expert Niroshan Rajadurai says putting developers at the center of everything will enable you to meet your security goals.

Security

The importance of improving supply chain security in open source

We think a lot about a high-profile supply chain attack that might cause developers, teams, and organizations to lose trust in open source. That’s why we’re investing in new ways to protect the open source ecosystem.

Security

Creating a more inclusive security research field

A glimpse into the backgrounds and day-to-day work of several GitHub employees in cybersecurity roles.

Security

Cybersecurity spotlight on bug bounty researcher @ahacker1

As we wrap up Cybersecurity Awareness Month, the GitHub bug bounty team is excited to spotlight one of the security researchers who participates in the GitHub Security Bug Bounty Program.

Security

What we learned from the Security Lab’s Community Office Hours

The GitHub Security Lab provided office hours for open source projects looking to improve their security posture and reduce the risk of breach. Here’s what we learned and how you can also participate.

Security

Why we’re excited about the Sigstore general availability

The Sigstore GA means you can protect your software supply chain today with GitHub Actions, and will power new npm security capabilities in the near future.

Application security

Introducing fine-grained personal access tokens for GitHub

Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.

Application security

5 tips for embedding security into your workflows

Having a robust security plan is key to innovation. These tips will empower you to gain the upper hand on cyberattacks, so you can ship quickly and innovate with ease.

Security

GitHub’s supply chain security features now support Dart

Cross-platform apps built with the popular Flutter toolkit can now benefit from Dependabot alerts.

Security

5 tips for prioritizing Dependabot alerts

Dependabot alerts can give you the ability to secure your project by keeping dependency-based vulnerabilities out of your code. Here are some tips to more efficiently prioritize and take action on your alerts, so you can get back to building.

Security

SCA vs SAST: what are they and which one is right for you?

We’re taking a look at two commonly-used security tools and detailing how they can help secure your projects.

Security

New request for comments on improving npm security with Sigstore is now open

Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.