Tag

Repository Security

9 articles

Latest in Repository Security

Blogs

GitHub Ties Every Commit to the Account That Pushed It

GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer information. A new repository rule can also block pushes w…

Oct 14, 20263 min

All Repository Security Articles

Showing 1–9 of 9

Sep21

Blogs

GitHub Separates Who Writes Code From Who Runs Your CI

GitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security.

3 min

Sep14

Blogs

More JFrog Artifactory Bugs Are Under Attack, and All Three Have Patches

Attackers are actively exploiting three JFrog Artifactory flaws, exposing how slow patching can turn artifact repositories into software supply chain attack paths.

3 min

Sep14

Blogs

GitLab’s Critical Patch Closes a Path Traversal Flaw Attackers Are Already Probing

GitLab patches two critical flaws, including a CVSS 10.0 unauthenticated file-read vulnerability, putting self-managed instances under urgent pressure to upgrade.

3 min

Sep11

Blogs

GitHub Widens the Door on Advanced Security Trials

GitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free.

3 min

Jul20

xAI Open-Sources Grok Build Coding Agent After Cloud Upload Exposes SSH Keys, Repos

xAI has published the full source code for Grok Build, its terminal-based AI coding agent, on GitHub under an Apache 2.0 license. The release lands three days after a security rese…

3 min

Jan07

DevOps

Fake Stars in GitHub a Growing Security Threat, Analysis Finds

There was a surge of inauthentic stars on code repositories in 2024, ramping up the threat of software supply chain attacks.

3 min

Mar31

Blogs

npm is Scam-Spam Cesspool ¦ Google in Microsoft Antitrust Thrust

In this week’s #TheLongView: The npm registry suffers spam infestation, and Microsoft makes Google sad.

3 min

Nov29

Blogs

DevOps and Security: Focus on Importance

Why have I written “DevOps and Security” and not DevSecOps or one of the other names that floats around? Because this post is aimed to apply to everyone—not just those far enough a…

3 min