GitHub Security Lab

AI-powered fuzzing is changing how we find vulnerabilities. GitHub Security Lab’s new Fuzzing Taskflow uses an LLM agent to automate the end-to-end fuzzing workflow for C/C++ projects—from identifying entry points and writing harnesses to improving coverage, triaging crashes, and generating vulnerability reports. Built on the GitHub Security Lab Taskflow Agent, it helps security researchers and maintainers spend less time babysitting fuzzers and more time investigating meaningful findings. Read Antonio Morales Maldonado's blog post and explore how autonomous fuzzing works: https://lnkd.in/gfGYpkhh #ApplicationSecurity #Fuzzing #AI #OpenSourceSecurity #Cybersecurity #GitHubSecurityLab

This year in particular, coordinated disclosure has come to the forefront as AI vulnerability discovery has democratized the ability for just about anyone to find and report vulnerabilities in software. The 100% year-over-year increase in CVEs highlights this, and I've been fortunate to be neck deep in the flood. So for THREATCON1, I thought it would be fun to put together a panel discussing the chaos of coordinated vulnerability disclosure and dig into some of the tough realities. Joining me for the discussion: Tod Beardsley (runZero / CVE Program Board Member), Caitlin Condon (VulnCheck), and Shelby Cunningham (GitHub). Come join us at THREATCON1 for a great discussion. Registration is free! https://lnkd.in/eFSQPdVd #cybersecurity #infosecurity #riskmanagement #securityresearch #aisecurity

A new secure default for GitHub Actions: For public repositories that do not already have an applicable event policy, GitHub is introducing a default rule that disables pull_request_target. Vulnerabilities in pull_request_target workflows are ones of the most commonly exploited vulnerabilities in action workflows. It initially runs in evaluate mode, so you can see which workflow runs would be affected before enforcement begins on November 2nd.

If you could secure your open source GitHub repo in less than 60 seconds, would you do it? Even the best open source repos face the following risks: 🚨 Malware pushed to your branches 📣 Unfixed vulnerabilities disclosed to the public 🔓 Leaked credentials 📦 Vulnerable dependencies 🐛 Security bugs in your code We recently wrote a guidance about the 6 security settings every GitHub maintainer should enable to mitigate those risks: https://lnkd.in/ec6DJQCJ That was so early 2026! Now you can get it done with one command. 🚀 Introducing gh secure One command. Free. No security expertise required. gh.io/gh-secure Raise your repository’s security baseline now: gh extension install GitHubSecurityLab/gh-secure gh secure --yes Learn more: https://gh.io/gh-secure

We're in! With sustainable and predictable recurring revenue, package registries can invest more in security capabilities –Artifact signing, trusted publishing, malware scanning and quarantine, build provenance attestations, SBOM and VEX generation, threat detection and incident response SLAs– that will make open source a safer place, for everyone!

Here are the GitHub August bug bounty stats! 🐛 497 bounty reports submitted 👥 222 hackers participated in our program 💰 Awarded $104,402 in bounties Found a vulnerability? Submit it here: https://bounty.github.com

“Peter ignored me, so I was like, how else can I get his attention? Security.” 🔐 Sometimes the best path into open source is finding where your security expertise can help—and being ready to keep learning. Meet the maintainers building and securing OpenClaw: gh.io/openclaw-interview #OpenSourceSecurity

Inspiring lessons from DataJourneyHQ ! Tools are setting a baseline, what matters is to turn security into a habit. 👏🏾 You can set the baseline for your open source project, the Security Lab gets you covered with that: install and run gh.io/gh-secure and you’ll be set in 2 minutes. And you’ll be ready for the next step, which is to include security in your routine!

Extract from Blog Post @ https://lnkd.in/eK-2v-zT 📢 Cucumber participated in the Session 4 of the GitHub Secure Open Source Fund, a program that brought together 50 open source projects across to level up security practices 🔒 For me personally, one big appeal or "pull-factor" was the chance to meet with over 70 maintainers who all are dealing with the same problems as all of us are in OSS. What niggles do they have? How do they manage their projects? How do they all try to keep us safe? Naturally the GitHub Secure Open Source Fund was also there to showcase the latest and greatest developments from GitHub - and on this point, it **did not** disappoint. We were able to utilise things like CodeQL and secret scanning to automate the generation of fixes across over 130 repositories - beyond these automated configurations and fixes, we've also made other notable changes: ✅ Workflows: SHA pinning and minimal permissions ✅ Process: Incident Response Plan, SBOM's and documented procedural changes ✅ Upskilling: How to look for vulnerabilities - special thanks to the GitHub Security Lab -> https://lnkd.in/eEaacCjG for this! So... what's next? Well if anything, it would simply be more of the same. A special thankyou from Cucumber goes out to GitHub, the entire GitHub Security Lab team - who delivered some awesome dedicated specific seminars showcasing a wide variety of attack patterns as well as Microsoft for Startups for helping provide us with Azure credits. Cucumber is now more secure thanks to the GitHub Secure Open Source Fund 🚀 #github #sosf #opensource #oss #cucumber