Turn Security into a Habit with gh-secure

CVE-2026-45321: a poisoned @tanstack release on May 11 stole a CrowdSec engineer's GitHub token. Eleven days later that token cloned 170 private repos. The breach stayed hidden for nearly four months. TeamPCP poisoned 84 @tanstack packages through a GitHub Actions cache injection and shipped the malicious tarballs with valid SLSA Build Level 3 provenance. The postinstall swept GitHub tokens, SSH keys, and cloud credentials off every machine in scope. The breach surface is developer identities, not lockfiles. Rotate every GitHub token, SSH key, and cloud credential on any machine that ran @tanstack installs between May 11 and May 15. Offboarding on the calendar lags the credential clock. Tie revocation to the supply chain alert or the notice date, whichever fires first. TRIS, the prioritization engine inside CVEasy AI, scores CVE-2026-45321 across four exposure layers. A developer machine reaching your GitHub org lands top ACT band. A sandboxed ephemeral runner with short-lived OIDC drops a band on the same finding. Same CVE, different hardware, different risk. https://lnkd.in/g9hNx-U3 Analysis by Chris Boker, Founder #SupplyChainSecurity #npm #CVE #AppSec #CTEM

CROWDSEC LEAK: 170 PRIVATE REPOS COPIED An attacker used a former employee's GitHub token to copy 170 CrowdSec private repos. The code exposed 83 user emails and 51 investor records. Read more: https://lnkd.in/dd4tkqRf #CrowdSec #GitHubLeak #TanStack #SupplyChainAttack #InfoSec #ThreatIntel

GitHub blocked my push because it found an API key in my commit. Annoying, but fine, I removed it, pushed again, moved on. The key never reached GitHub, so no harm done. An hour later my app stopped working in production. 401 UNAUTHENTICATED. The key was dead. Here's the part I didn't know: GitHub's secret scanning doesn't just block the push. It reports the key to the provider, who revokes it. Google is one of their partners. My key was cancelled within the hour, even though the push was rejected and nothing was ever published. Which reframes the whole thing. I'd been treating a leaked credential as a risk to manage. "I should rotate that at some point." It isn't a risk. It's already gone. The provider makes the decision for you, quickly, and you find out when production breaks. Two things I do differently now: 1. `.gitignore` before the first commit, not after the first scare 2. `git status` read properly before `git add -A`, the file that caught me   was one I didn't know existed in my project root The push protection is the last line of defence, not the first. It only catches key formats it recognises. A database password or a signing key would have gone straight through. #SoftwareEngineering #Security #Git #DevOps

Anyone can federate Identity to a variety of easy to use IdPs like Github, Google, and Meta. But ultimately this is putting the controls in someone else's hands. There are some really good SaaS options out there like Auth0, but that is yet another 3rd Party who controls the locks to your house. In "Idp, locally, with Authentik", I show how to setup the open-source version of Authentik in both Docker and Kubernetes. The positives of Authentik is that it's very configurable. But the negatives are also that it is very configurable. Most guides I had seen just show the basic install. In this post we launch locally then build an app (link to Github below for it) that can federate to our own Authentik. I show how to add users, use the federated IdP landing page and then externalize Authentik in how one might deploy. Because this is a real app I may depend upon, we wrap by showing how to use Databasus backups on the PostgreSQL backend. In "Bye Windows", I catalog my conversion of my gaming PC to Linux. This is the last Windows box in my fleet and I think I just have had enough of Copilot OS. I do not need more advertisements popping up or in my start menu. I walk through all the things I tend to setup - Zed, Homebrew, ffmpeg, imagemagik, cloud connections (AWS, Azure, GCP) and command line tools. I cover the 'fun' stuff as well like Steam and Mullvad VPN. Pretty much once I added VLC, GIMP and OBS, I had all that I needed. I still need to see if I can get the older Canon software working with OBS so I can use the SLR in videos and the older Shure microphone suite isn't there (but the Mic works fine). I might get grief for using Ubuntu instead of something hipper like Arch, but I actually like gnome. I see no reason to make my life harder just for street cred. Since you read this far, I'll note I also switched to zfs. I use btfs elsewhere and my laptops have just been ext4. I had one hard crash so far and zfs was a champ on reboot so I think it's doing its job. I know a lot of people extol the virtues of ZFS backups, but I treat my daily drivers as crops not flowers so I could care less if it dies and i have to rebuild. Important stuff doesn't stay local anyhow. URLs: - Authentik Sample App: https://lnkd.in/gjQdTQQT Articles: - Bye Windows: https://kutt.tpk.pw/LpQr3r - Idp, Locally, with Authentik: https://kutt.tpk.pw/fELACn #idp #selfhosted #docker #kubernetes #linux #authentik #ubuntu

Calling for help with submitting a GitHub issue. My track record on submitting issues and comments on GitHub issues is mixed. I need help from #Pandas and #WCAG and #Accessibility experts. While working on an accessibility pass for a small Quarto site, I ran into something. Pandas' DataFrame.to_markdown() (which wraps the tabulate library) leaves the top-left corner cell of a table blank whenever the index has no name. It's such a common convention that it just reads as normal (for many). But that blank cell is a <th> with no text in it, and for someone using a screen reader, an empty header means the relationship between that row and its values isn't announced. I think this is likely a yet-to-be spoken "miss" on WCAG 1.3.1 (Info and Relationships), and because this is a default behavior in a widely-used library, it likely ends up on a lot of published pages (tutorials, reports, documentation sites) without anyone involved making a deliberate choice about it. There's already an open issue on the tabulate repo about the related columns.name display bug, and pandas has pointed to tabulate as the source of the behavior. But as far as I can tell, nobody has framed the blank-header piece specifically as an accessibility question in either tracker. I want to be thoughtful rather than just showing up and declaring a problem. So I'm asking: Is this actually a fair characterization of the WCAG issue, or am I overreaching? Is a GitHub issue/comment even the right way to raise this, or is there a better venue? If it is worth raising, how do I do that well? Genuinely open to being told this is lower-priority than it feels. No need to either over- nor under-state the urgency. Who has thoughts?

Shipped a small thing in no-vull this weekend: the menu bar now shows status for GitHub, Claude, and ChatGPT alongside your scan results. The reasoning: agents depend on these services now. When one degrades mid-scan, I'd rather know in a single glance than debug why my analysis came back thin. This morning was a decent test — GitHub had an incident and the labs were throwing elevated errors. All visible before I read a single vulnerability. The rest of the popup is doing its usual job. Scanned a repo after a pull and caught a critical file read in vitest, an auth bypass in next, and an SDK issue. You get plain-English explanations, dependency counts (some of these packages have over a million dependents), and an action plan with the actual version numbers to bump to. It's a local tool — npm audit + OSV.dev + LLM analysis, results in the menu bar. One command to set it up on a repo: no-vull target ~/my-app Then every git pull kicks off a scan in the background. Give it a spin on one of your repos. And if it saves you from a bad afternoon, a star on GitHub always helps: https://lnkd.in/gAkQFv-5 Open source — feedback welcome. #opensource #devtools #security #npm #softwaresecurity

kesec — a self-hosted password manager I built recently, but the real story is what's running underneath it. I didn't stop at "make it work." I built a complete DevSecOps pipeline around it: every push to main gets scanned for leaked secrets (Gitleaks), vulnerable dependencies (OWASP Dependency-Check), vulnerable container images (Trivy), and code quality issues (SonarQube) — and none of it is just reporting. Each one is a real gate. If any of them fail, nothing gets built, pushed, or deployed. Some things I ran into along the way that taught me more than the "happy path" ever would: 🔍 Found and worked around a real supply-chain compromise in a popular GitHub Action mid-project — a good reminder that "trusted" tooling still needs scrutiny 🐳 Debugged a runtime security monitor (Falco) failing silently on a cloud provider's customized kernel, down to kernel-level eBPF internals 🔐 Pinned every base image to an exact digest instead of a floating tag, with Dependabot keeping them current through reviewable PRs — not silent, unreviewed changes Stack: FastAPI + Next.js + MySQL, containerized with Docker, deployed on GCP behind Caddy, fully automated through GitHub Actions. Security isn't a checkbox you add at the end — it's a set of gates you build into how the software actually ships. That's the part of this project I'm most proud of. Repo Link: https://lnkd.in/gv4-sRSR Website URL: http://8.234.91.131/login #DevSecOps #CI/CD #SoftwareEngineering #Docker #GitHubActions #CloudSecurity #Python #NextJS

Some of the best developers have almost nothing to show on public GitHub. That doesn't mean they aren't building. A developer might spend years working on: • private company repositories • internal platforms • enterprise products • client projects they can't share publicly So an almost empty GitHub profile isn't automatically a negative signal. And a profile full of activity isn't automatically a positive one either. The useful question isn't: “How active is this person on GitHub?” It's: “What can the public information actually tell us, and what can't it tell us?” GitHub can give recruiters useful technical context. But absence of public activity should never become a reason to automatically overlook someone. That's also how we think about technical signals at Sonar Air: context first, activity counts second. Recruiters, when you find a developer with an almost empty GitHub profile, do you keep investigating or usually move on?

I had a great experience with the GitHub Trust & Safety team this week that’s worth highlighting. I came across a repository that appeared to be distributing malicious software under the guise of a legitimate Web3 project. The repo included several red flags that included automated execution, hidden configuration, credential exfiltration, and remote code execution behavior. I reported it to GitHub with the technical evidence. Within hours, their team reviewed the account, confirmed that violations had occurred, and took action. The removed the user account and the malicious content. That kind of response matters. As more development becomes AI assisted and open source code moves faster than ever, platforms like GitHub sit at a critical point in the software supply chain. Speed, trust, and strong security controls are becoming just as important as developer productivity. I appreciate the GitHub team for taking the report seriously and moving quickly. A good reminder for all of us, when something looks wrong, don’t assume someone else will report it. Security is a shared responsibility.

Day 11 🚀 One of the most common (and dangerous) mistakes developers make: accidentally committing a .env file to GitHub. Your .env file holds real secrets, database passwords, API keys, JWT signing secrets. Push it to a public repo, even by accident, and bots scan GitHub constantly looking for exactly that. Exposed keys can be found and abused within minutes, not days. The fix is simple but easy to forget: add .env to your .gitignore before your first commit, not after. If you've already pushed one, deleting it later isn't enough, the secret is still in your git history, you have to rotate the actual keys. Small habit, but it's the difference between a clean deploy and a very bad day. #OpenToWork #FullStackDeveloper #WebDevelopment #GitHub