GitHub Security Lab

For years, I've argued about how hard it is for open source maintainers to handle security reports. Today I want to give credit where it's due: GitHub just shipped a whole batch of updates to private vulnerability reporting and security advisories, and it directly addresses the pain points maintainers have been raising for a while. In two days, they landed: 1. Structured forms for private vulnerability reports. No more anonymous free-text dumps. Reporters now fill in summary, details, proof of concept (minimum 150 characters), and impact. You can customize the form with a `.github/VULNERABILITY_REPORT.yml` file, require a CWE assignment, and even let reporters disclose that they used AI assistance. Anyone who has triaged a flood of low-quality or AI-generated reports knows how much this helps separate signal from noise. 2. Rate limits for private vulnerability reports. Bulk and automated submissions were burying the reports that actually mattered. Daily per-user caps, a custom repo limit, and an allow list for trusted reporters mean legitimate researchers still reach you while the spam gets throttled. 3. Confidential comments on repository security advisories. This one is personal for me. You can now post comments visible only to maintainers, so you can discuss abuse, investigation details, and coordination without the reporter seeing everything. It's marked in the timeline, follows repository permissions, and is audit-logged. No more moving sensitive discussion to another tool and losing it from the advisory's history. 4. A REST API for advisory comments, in public preview. The triage discussion used to live only in the web UI. Now you can list, get, add, and edit comments programmatically, plus see comment counts on advisory responses. Now I can fully automate my response flow... to fight the horde. 5. New fields in the SecurityAdvisory GraphQL API: `cveId`, `sourceCodeLocation`, `githubReviewedAt`, `nvdPublishedAt`, and `repositoryAdvisoryUrl`, plus `severities` and `isWithdrawn` filters. Fewer round trips, one authentication path, one rate limit budget for integrations. Severity-based triage feeds and tracking how fast advisories move from NVD to GitHub review just got much easier. You know that I'm not one to hand out praise lightly: I've spent my share of time complaining about the incentive structures around security in open source. But this batch of changes is thoughtful and maintainer-first. It makes reporting better structured, the inbox saner, and the private coordination we need actually possible. Thank you, GitHub. This is exactly the kind of investment in the OSS security ecosystem that matters. If you maintain a public repository, enable private vulnerability reporting and give these a spin.

Hey, #THREATCON1 attendees! 👋🏾 Catch Shelby Cunningham from the Security Lab on Wednesday, Oct. 7 at 11 AM for a candid panel on coordinated vulnerability disclosure—from AI-driven discovery and research collisions to vendor silence and when to publish a PoC. See you there! https://lnkd.in/ghdG9s9h

Here are the September GitHub bug bounty stats! ✅ 454 bounty reports submitted 👥 203 hackers participated in our program 💰 Awarded $56,472 in bounties Found a vulnerability? Submit it here: https://bounty.github.com

It's day 2 of good news about open source software security this week. Almost exactly a year ago, GitHub Actions and npm were getting rocked by the Shai Hulud family of attacks, where malware was added to hundreds of popular open source packages over the course of a few hours. Dozens of folks across Microsoft, GitHub, npm, and open source communities came together to brainstorm, deploy, and iterate on security capabilities over the past year to prevent these attacks. There continue to be copycat attacks, but because of these defense-in-depth, overlapping security capabilities, these attempts have not spread. I gave a presentation at USENIX Association's Security Enigma track about these attacks and the mitigations we've deployed, and the recording is now up at https://lnkd.in/gS2ke826.

Today the Security Lab Advisory Database team is shipping 5 (five!) updates that will support maintainers triaging and addressing vulnerability reports. From improving submission quality, to controlling bulk submissions, to supporting your automation needs, we hope that all these features will help maintainers address the security reports that matter!

How can AI help uncover real-world mobile security flaws? GitHub Security Lab used its open-source AI security agent to find and report 24 Android vulnerabilities—including issues affecting user privacy and account security. Read the research: https://lnkd.in/ekNJeTuE

AI-powered fuzzing is changing how we find vulnerabilities. GitHub Security Lab’s new Fuzzing Taskflow uses an LLM agent to automate the end-to-end fuzzing workflow for C/C++ projects—from identifying entry points and writing harnesses to improving coverage, triaging crashes, and generating vulnerability reports. Built on the GitHub Security Lab Taskflow Agent, it helps security researchers and maintainers spend less time babysitting fuzzers and more time investigating meaningful findings. Read Antonio Morales Maldonado's blog post and explore how autonomous fuzzing works: https://lnkd.in/gfGYpkhh #ApplicationSecurity #Fuzzing #AI #OpenSourceSecurity #Cybersecurity #GitHubSecurityLab

This year in particular, coordinated disclosure has come to the forefront as AI vulnerability discovery has democratized the ability for just about anyone to find and report vulnerabilities in software. The 100% year-over-year increase in CVEs highlights this, and I've been fortunate to be neck deep in the flood. So for THREATCON1, I thought it would be fun to put together a panel discussing the chaos of coordinated vulnerability disclosure and dig into some of the tough realities. Joining me for the discussion: Tod Beardsley (runZero / CVE Program Board Member), Caitlin Condon (VulnCheck), and Shelby Cunningham (GitHub). Come join us at THREATCON1 for a great discussion. Registration is free! https://lnkd.in/eFSQPdVd #cybersecurity #infosecurity #riskmanagement #securityresearch #aisecurity

A new secure default for GitHub Actions: For public repositories that do not already have an applicable event policy, GitHub is introducing a default rule that disables pull_request_target. Vulnerabilities in pull_request_target workflows are ones of the most commonly exploited vulnerabilities in action workflows. It initially runs in evaluate mode, so you can see which workflow runs would be affected before enforcement begins on November 2nd.