… May.26 Release Dependabot version updates now support the sbt ecosystem supply chain security May.22 Release Staged publishing and new install-time controls for npm supply chain security May.19 Retired Upcoming deprecation of Python 3.9 for Dependabot supply chain security May.19 Improvement Expand…
… May.26 Release Dependabot version updates now support the sbt ecosystem supply chain security May.19 Retired Upcoming deprecation of Python 3.9 for Dependabot supply chain security May.19 Improvement Expanded OIDC support for Dependabot and code scanning application security supply chain security M…
… By default, GitHub Agentic Workflows run in a strict security mode with this threat model in mind, and their design is guided by four security principles: defense in depth, don’t trust agents with secrets, stage and vet all writes, and log everything. …
… Specifically, GitHub partners with the OpenSSF to support this security capability, called trusted publishing, in package repositories, which is now supported across npm, PyPI, NuGet, RubyGems, Crates, and other package repositories. …
… We want to give enterprises the ability to define clear trust boundaries for workflow execution, secret access, and event triggers without encoding complex security logic into every workflow file. …
… When an “attack” requires the victim to actively seek out and engage with attacker-controlled content cloning a malicious repo, asking an AI tool to analyze untrusted code, opening a crafted file , the security boundary is the user’s decision to trust that content. …
… Our plan for a more secure npm supply chain Addressing a surge in package registry attacks, GitHub is strengthening npm’s security with stricter authentication, granular tokens, and enhanced trusted publishing to restore trust in the open source ecosystem. …
… Our plan for a more secure npm supply chain Addressing a surge in package registry attacks, GitHub is strengthening npm’s security with stricter authentication, granular tokens, and enhanced trusted publishing to restore trust in the open source ecosystem. …
… To get started, configure custom properties on your repositories and reference them in your cloud provider’s OIDC trust policy. …
… Tags: agentic AI security AI security coding training cybersecurity GitHub Security Lab secure coding Written by Related posts AI & ML Improving token efficiency in GitHub Agentic Workflows Agentic workflows that run on every pull request can quietly accumulate large API bills. …