Hello Security researchers! Here are GitHub's July bug bounty stats! 💪 🐛 530 bounty reports submitted 👥 284 hackers participated in our program 💰 Awarded $267,652 in bounties Found a vulnerability? Submit it here: https://bounty.github.com Heading to DefCon? Come find us, details here: https://lnkd.in/egHwy3FY
About us
- Website
-
https://securitylab.github.com
External link for GitHub Security Lab
- Industry
- Software Development
Updates
-
GitHub Security Lab reposted this
Do you want to help secure open source? The GitHub Security Lab hires a Staff Developer Advocate!
-
GitHub Security Lab reposted this
Malicious package releases are one of the fastest-moving supply chain threats and automated dependency updates can pick up a malicious package release before maintainers and security researchers have time to catch it. We made a three-day cooldown the default for Dependabot version updates to give new releases a little more time for review before Dependabot opens a pull request. Security updates still open immediately, and if you want, you can adjust the cooldown to fit your project. Read more here: https://lnkd.in/gqC957Yx A big thank you to Jamie Tanna and the Renovate team, Nicky Ringland, Elitsa Bankova, Xueqin Cui and the Google Open Source team for sharing their expertise and ideas. In addition to being awesome people they write awesome content, and you can read about all of our approaches here - Renovate: https://lnkd.in/gwN6wa7n GOSSIP: https://lnkd.in/gZiApJU6 And of course, it wouldn't be possible without the folks at GitHub who helped build this feature: Ankit Kumar Honey, Trevor Rosen, Zach Steindler, Robert Aiken, Marcelo Oliveira, Aaron Cathcart, Xavier René-Corail, Colten Woo 🔒
-
Hey bounty hunters! GitHub updates its bug bounty program to improve how the company partners with the security research community. The new structure is designed to reduce ambiguity, prioritize the areas of highest risk, and improve the speed and quality of security outcomes. By aligning incentives more closely with impactful findings and streamlining triage, GitHub is reinforcing a security strategy built on transparency, collaboration, and continuous improvement. https://lnkd.in/etE7DZzB
-
Don't miss your chance to participate in this program! We have mobilized experts (from our team, from GitHub, and from the community) to deliver a training program that will make a huge difference to your security posture! Apply!
🚀 Applications for Session 5 of the GitHub Secure Open Source Fund are now open! Link to Apply: https://lnkd.in/g57hbHCb Selected projects receive security training and $10,000 in non-dilutive funding. Please repost, tag a maintainer in the comments, or encourage a project you rely on to apply. (Link with more information in comments)
-
-
Learn how generative AI is changing cybersecurity and the threat landscape - join the panel with our security researcher, Sylwia Budzynska, at EuroPython ! https://lnkd.in/eKZK3NVR
-
Are you in Krakow for EuroPython? Getting started with finding vulnerabilities and securing software can seem daunting, but doesn’t have to be. Join Sylwia Budzynska at EuroPython for “Introduction to security research. Find a CVE with CodeQL.” to learn how to look for vulnerabilities in code and query for them with CodeQL. The workshop is intended for developers interested in security, open source maintainers and security researchers. 📆 Tuesday, 14th July ⏰ 13:45 📌 Kraków, Poland https://lnkd.in/g2xyZrXD
Join Sylwia B. at EuroPython for "Introduction to security research. Find a CVE with CodeQL." tutorial: https://lnkd.in/e8c5mtMC Get your ticket: https://lnkd.in/dD4H_bkB
-
-
6 GitHub security settings every maintainer should enable this week. These won't make your project unhackable. Nothing will. What they do is close the easy doors... the ones attackers try first. Free, fast, and worth the few minutes it takes. 🔗 https://lnkd.in/ec6DJQCJ
-
GitHub Actions Security is on a roll! New secure default to combat cache poisoning!
Today we are shipping the next change to make GitHub Actions secure by default and disrupt supply chain attacks: the Actions cache is now read-only for untrusted workflow triggers. This one directly addresses a class of attack that security researchers have been demonstrating for years, most notably Adnan Khan's work on cache poisoning. The Actions cache is shared across workflows that run on a repository's default branch. A low-privilege or vulnerable workflow, like a pull_request_target with a script injection, a pwn request, or an agent with prompt injection, can poison that cache. A more privileged workflow, like a scheduled publish job, then restores the poisoned entry and runs attacker-controlled code with its secrets. This has been the escalation path behind several recent supply-chain incidents. This change applies least privilege to the cache. Events that are triggered by users with write access and commonly write the default-branch cache, like push and schedule, keep full read-write access. Untrusted triggers, meaning those that can be fired by users without write access to the repository, now receive a read-only cache token by default. We are also working on controls to let teams go further and restrict cache reads and customize cache access for their most sensitive workflows. If you have input on how that should work, we are gathering feedback in the GitHub Community discussion linked in the comments. The full changelog, including which triggers keep read-write caching, is linked in the comments. The Actions product and engineering teams have been crushing it, getting these supply chain hardening releases out the door. Quickly iterating on ideas, scoping their real impact, and making the hard calls that matter. It has been a great group to work with.
-
What happens when you hand an AI agent its own tools, memory, and a path to production? Season 4 of the Secure Code Game is live, and this time the target is agentic AI security. Meet ProdBot. An AI agent built to be broken. It runs on MCP servers, skills, and multi-agent workflows, and every layer is a door someone could walk through. Your job is to find the cracks before an attacker does. Play now: gh.io/scg Free. Open source. Get started in 2 minutes right from your browser. P.S. ProdBot does not know it is vulnerable yet. That part is on you!
