Security

Latest

• 

  Creating a more comprehensive dependency graph with build time detection

  Expand the completeness of your dependency graph by using the dependency submission API, which will create more comprehensive alerts on supply chain vulnerabilitiesCourtney Claessens·June 17, 2022

  Learn more
• 

  The Android kernel mitigations obstacle race

  In this post I’ll exploit CVE-2022-22057, a use-after-free in the Qualcomm gpu kernel driver, to gain root and disable SELinux from the untrusted app sandbox on a Samsung Z flip 3. I’ll look at various mitigations that are implemented on modern Android devices and how they affect the exploit.Man Yue Mo·June 16, 2022

  Learn more
• 

  GitHub now publishes malware advisories in the GitHub Advisory Database

  To combat the prevalence of malware in the open source ecosystem, GitHub now publishes malware occurrences in the GitHub Advisory Database. These advisories power Dependabot alerts and remain forever free and usable by the community.Brittany O'Shea, Kate Catlin·June 15, 2022

  Learn more
• 

  GitHub brings supply chain security features to the Rust community

  The Rust community can now discover, report, and prevent security vulnerabilities.Courtney Claessens·June 6, 2022

  Learn more
• 

  Eight years of the GitHub Security Bug Bounty program

  It was another record year for our Security Bug Bounty program. We’re excited to highlight some achievements we’ve made together with the bounty community from 2021!Jill Moné-Corallo·May 23, 2022

  Learn more
• 

  Today’s most common security vulnerabilities explained

  We’re taking a look at some of the most common security vulnerabilities and detailing how developers can best protect themselves.Joseph Katsioloudes·May 6, 2022

  Learn more
• 

  Best practices to keep your projects secure on GitHub

  These days software is subject to an ever-changing threat landscape. Check out the many ways you can keep your projects secure on GitHub today.Justin Hutchings·April 28, 2022

  Learn more
• 

  Why you shouldn’t fear requesting a CVE for your open source project

  Do you worry that a CVE will hurt the reputation of your project? In reality, CVEs are a tracking number, and nothing more. Here’s how we think of them at GitHub.Madison Oliver·April 22, 2022

  Learn more
• 

  Sharing security expertise through CodeQL packs (Part I)

  Introducing CodeQL packs to help you codify and share your knowledge of vulnerabilities.Andrew Eisenberg·April 19, 2022

  Learn more
• 

  Git Credential Manager: authentication for everyone

  Ensuring secure access to your source code is more important than ever. Git Credential Manager helps make that easy.Matthew John Cheetham·April 7, 2022

  Learn more
• 

  Achieving SLSA 3 Compliance with GitHub Actions and Sigstore for Go modules

  Learn how to build packages with SLSA 3 provenance using GitHub Actions.Jose Palafox·April 7, 2022

  Learn more
• 

  Prevent the introduction of known vulnerabilities into your code

  The new dependency review action and API prevents the introduction of known supply chain vulnerabilities into your code.Courtney Claessens·April 6, 2022

  Learn more
• 

  How Dependabot empowers you to keep your projects secure

  We want to take away the pain and effort of keeping your code secure, so check out how Dependabot empowers developers to keep to their projects secure.Brittany O'Shea·April 6, 2022

  Learn more
• 

  How to secure your end-to-end supply chain on GitHub

  Securing your projects is no easy task, but end-to-end supply chain security is more top of mind than ever. We’ve seen bad actors expand their focus to taking over user…Zachary Steindler·March 28, 2022

  Learn more
• 

  Validate all the things: improve your security with input validation!

  If there’s one habit that can make software more secure, it’s probably input validation. Here’s how to apply OWASP Proactive Control C5 (Validate All Inputs) to your code.Jaroslav Lobacevski·March 21, 2022

  Learn more