Ascendant Bot
- Amazon Security Lake , Application security , GitHub , GitHub Advanced Security , Secret Protection , Secret Scanning
- April 1, 2025
GitHub found 39M secret leaks in 2024. Here’s what we’re doing to help
Every minute, GitHub blocks several secrets with push protection—but secret leaks still remain one of the most common causes of security incidents. Learn how GitHub is making it easier to protect yourself from exposed secrets, including today’s launches of standalone Secret Protection, org-wide scanning, and better access for teams of all sizes.
The post GitHub found 39M secret leaks in 2024. Here’s what we’re doing to help appeared first on The GitHub Blog.
- Amazon Security Lake , Career in Cybersecurity , CVE integration , GitHub , GitHub Security Tools , open source security , private vulnerability reporting , security advisories , Supply chain security , vulnerability disclosure , Vulnerability research
- March 24, 2025
A maintainer’s guide to vulnerability disclosure: GitHub tools to make it simple
A step-by-step guide for open source maintainers on how to handle vulnerability reports confidently from the start.
The post A maintainer’s guide to vulnerability disclosure: GitHub tools to make it simple appeared first on The GitHub Blog.
- Amazon Security Lake , authentication , GitHub , GitHub Security Lab , ruby , SAML , Vulnerability Detection , Vulnerability research
- March 12, 2025
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0. In this blog post, we’ll shed light on how these vulnerabilities that rely on a parser differential were uncovered.
The post Sign in as anyone: Bypassing SAML SSO authentication with parser differentials appeared first on The GitHub Blog.
- Amazon Security Lake , GitHub
- March 10, 2025
Full exposure: A practical approach to handling sensitive data leaks
Treating exposures as full and complete can help you respond more effectively to focus on what truly matters: securing systems, protecting sensitive data, and maintaining the trust of stakeholders.
The post Full exposure: A practical approach to handling sensitive data leaks appeared first on The GitHub Blog.
- Amazon Security Lake , CI/CD , CodeQL , DevSecOps , Engineering , GHAS , GitHub , Product Security , SAST
- February 12, 2025
How GitHub uses CodeQL to secure GitHub
How GitHub’s Product Security Engineering team manages our CodeQL implementation at scale and how you can, too.
The post How GitHub uses CodeQL to secure GitHub appeared first on The GitHub Blog.
- Amazon Security Lake , GHAS , GitHub
- February 7, 2025
From finding to fixing: GitHub Advanced Security integrates Endor Labs SCA
The partnership between GitHub and Endor Labs enables application security engineers and developers to drastically reduce time spent on open source vulnerabilities, and gives them the tools to go from finding to fixing.
The post From finding to fixing: GitHub Advanced Security integrates Endor Labs SCA appeared first on The GitHub Blog.
- Amazon Security Lake , Application security , Career in Cybersecurity , GitHub , security research , Vulnerability Detection , Vulnerability research
- January 29, 2025
Cybersecurity researchers: Digital detectives in a connected world
Discover the exciting world of cybersecurity research: what researchers do, essential skills, and actionable steps to begin your journey toward protecting the digital world.
The post Cybersecurity researchers: Digital detectives in a connected world appeared first on The GitHub Blog.
- Amazon Security Lake , exploit development , GitHub , java , maven , Supply chain security , Vulnerability research
- January 22, 2025
Attacks on Maven proxy repositories
Learn how specially crafted artifacts can be used to attack Maven repository managers. This post describes PoC exploits that can lead to pre-auth remote code execution and poisoning of the local artifacts in Sonatype Nexus and JFrog Artifactory.
The post Attacks on Maven proxy repositories appeared first on The GitHub Blog.
- Amazon Security Lake , Book of News , Diversity and Inclusion , GitHub , Maintainers , NVIDIA Research , Open Source
- January 21, 2025
Seven years of open source: A more secure and diverse ecosystem
Explore insights into open source community growth, innovation, and inclusivity with an updated survey dataset.
The post Seven years of open source: A more secure and diverse ecosystem appeared first on The GitHub Blog.
- Amazon Security Lake , Application security , CodeQL , GitHub , GitHub Security Lab
- January 9, 2025
How to secure your GitHub Actions workflows with CodeQL
In the last few months, we secured 75+ GitHub Actions workflows in open source projects, disclosing 90+ different vulnerabilities. Out of this research we produced new support for workflows in CodeQL, empowering you to secure yours.
The post How to secure your GitHub Actions workflows with CodeQL appeared first on The GitHub Blog.
