Ascendant Bot
- Amazon Security Lake , Career in Cybersecurity , CVE integration , GitHub , GitHub Security Tools , open source security , private vulnerability reporting , security advisories , Supply chain security , vulnerability disclosure , Vulnerability research
- March 24, 2025
A maintainer’s guide to vulnerability disclosure: GitHub tools to make it simple
A step-by-step guide for open source maintainers on how to handle vulnerability reports confidently from the start.
The post A maintainer’s guide to vulnerability disclosure: GitHub tools to make it simple appeared first on The GitHub Blog.
- CI/CD , Dependabot , Developer skills , GitHub , GitHub Actions , GitHub Copilot , Supply chain security
- March 5, 2025
Video: How to run dependency audits with GitHub Copilot
Learn to automate dependency management using GitHub Copilot, GitHub Actions, and Dependabot to eliminate manual checks, improve security, and save time for what really matters.
The post Video: How to run dependency audits with GitHub Copilot appeared first on The GitHub Blog.
- Amazon Security Lake , exploit development , GitHub , java , maven , Supply chain security , Vulnerability research
- January 22, 2025
Attacks on Maven proxy repositories
Learn how specially crafted artifacts can be used to attack Maven repository managers. This post describes PoC exploits that can lead to pre-auth remote code execution and poisoning of the local artifacts in Sonatype Nexus and JFrog Artifactory.
The post Attacks on Maven proxy repositories appeared first on The GitHub Blog.
- DevSecOps , Enterprise software , GitHub , GitHub Artifact Attestations , SLSA , Supply chain security
- December 19, 2024
Enhance build security and reach SLSA Level 3 with GitHub Artifact Attestations
Learn how GitHub Artifact Attestations can enhance your build security and help your organization achieve SLSA Level 3. This post breaks down the basics of SLSA, explains the importance of artifact attestations, and provides a step-by-step guide to securing your build process.
The post Enhance build security and reach SLSA Level 3 with GitHub Artifact Attestations appeared first on The GitHub Blog.
- CVE , Cybersecurity , GitHub , GitHub Security Lab , Supply chain security , Vulnerability research
- October 21, 2024
Securing the open source supply chain: The essential role of CVEs
Vulnerability data has grown in volume and complexity over the past decade, but open source and programs like the Github Security Lab have helped supply chain security keep pace.
The post Securing the open source supply chain: The essential role of CVEs appeared first on The GitHub Blog.
- Climate , Cybersecurity , GitHub , GitHub Actions , Supply chain security
- October 8, 2024
The second half of software supply chain security on GitHub
Learn about a community-developed framework for how to think about this problem holistically and how to use GitHub, particularly, to improve the security in the second half of your software supply chain.
The post The second half of software supply chain security on GitHub appeared first on The GitHub Blog.
- cloud-native , GitHub , GitHub Artifact Attestations , GitHub Security Lab , Supply chain security
- July 30, 2024
Configure GitHub Artifact Attestations for secure cloud-native delivery
Introducing the generally available capability of GitHub Artifact Attestations to secure your cloud-native supply chain packages and images.
The post Configure GitHub Artifact Attestations for secure cloud-native delivery appeared first on The GitHub Blog.
