GitHub

Almost that time of year again 🌁 #GitHubUniverse kicks off October 29 in San Francisco. Grab your pass or join us virtually ⬇️ https://lnkd.in/ekEPcraZ

Agents don’t just help build features. They can help try to break them, too. In our latest GitHub Podcast episode, Sameen Karim takes us behind the scenes on building stacked PRs. Listen to it wherever you get your podcasts or at https://lnkd.in/ejv_jERQ

AI has changed how devs work. Here are 3 career skills that will set you apart 👇 https://lnkd.in/dMdGzHbP

The GitHub Security Lab used an open-source agent to find 24 Android vulnerabilities, including a location leak in a navigation app with 10M downloads. How to run the taskflows on your own project 💡 https://lnkd.in/ekNJeTuE

Your workflows have changed with AI. How about your setup? Physical controls are back. Take the new Logitech MX Keypad, now directly integrated with the GitHub Copilot app. This experience allows you to run agentic workflows with control, map a repeated prompt, start or resume a session, and help you stay in flow. https://lnkd.in/eCkecxi6

New in GitHub Transparency data: Learn about government takedown requests and reporting, and get a recap of 2026 state legislative sessions affecting open source. https://lnkd.in/dkPjibdE

What are your conference essentials? Grab a #GitHubUniverse pass to join us in-person October 28-29 or sign up to join us virtually ⬇️ https://lnkd.in/ehADTRup

This week on Open Source Friday, we’re joined by Manfred Riem and Nicole Haugen to celebrate the 1.0.0 release of Spec Kit! We'll dig into the new features and capabilities of Spec Kit like programmable workflows, reusable bundles, a growing community, and so much more. We'll also touch on what goes into making a 1.0 release for an open source project. If you’re curious about open source, developer tooling, and how ideas turn into practical projects, this stream is for you. Catch up on the introduction to Spec Kit on a previous Open Source Friday: https://lnkd.in/eWjTPQTA

Pushes to GitHub grew nearly 3x over the past year. There's more code coming in than ever and more of it is written by agents. One in three pull requests now involves an AI agent, up from fewer than one in ten a year ago. At that pace, agents could be writing most of it within a year. Every one of those pushes can carry a secret. Once it's in git history, it's too late. You have to assume it's compromised and rotate it, and rotation is slow and painful. Manual revocation takes about 40 days on average. One in five takes more than 90. So the name of the game is prevention. Stop the secret before the push lands. Push protection already does that for tokens with a recognizable pattern. Unstructured secrets were the gap. A database password has no prefix, and telling it apart from a placeholder takes context. Context meant an LLM, and LLM latency made that impossible inside the push window. Those secrets only got caught after they were already in history. So we looked for an alternative, and we weren't married to any one technology. We ended up with a hybrid solution, where regex still casts the net for candidates and a small fine-tuned model makes the call from the surrounding code, in under 2 ms per batch. Then the team kept hill climbing on precision and recall until it beat the LLM pipeline it replaced, offline and online: - 13% higher precision, 19% higher recall - 11.5% higher acceptance from repo owners in an A/B test - 86% faster scans Now unstructured secrets get stopped at the push. That could more than double the number of secrets we prevent. Why it matters: https://lnkd.in/g6etMfxA How it works: https://lnkd.in/g7UcFuVd Proud of this team: Erin Havens for the product leadership. Batu Ozturkler, Shengyu Fu, Simona (Zhehui) Liao and the Applied Sciences team at Microsoft CoreAI for the research partnership. Robert Bolender, Krystal Mitchell and Ashwin Mohan for technical leadership, and Jarrod Schnapper for our experimentation pipeline. John Gregson for business planning. Colten Woo for marketing. Michael Badgett, Daniel Dunn, Jessica Schumaker, Adriana Babakanian, Gleb Irovich and Aakash Shah for bringing the model into developer surfaces.

We want to help keep the vibrant developer community connected in light of the Grace Hopper Celebration's cancellation. If you had plans to be in California this month, GitHub would love to welcome you to Universe (Oct 28–29 in SF). We’ve set aside 75 complimentary passes for those with a cancelled registration (1 per person please). DM us for details. We'll accommodate valid requests on a first-come, first serve basis.