GitHub’s Ignored Pause
Maintenance bypassed the stop.
GitHub
GitHub Recovered. Reconcile Releases
Reconcile before replaying.
Keep CodeQL Scanning When Your Runner Changes
Check runners, query packs and completed results before a pipeline change.
Validate GitHub Advisory Provenance
Decide what the next workflow can tolerate before changing where its data comes from.
The Coding Test Ran on Opening
A project deserves isolation before it reaches the working environment. Keep the review separate from the ordinary desktop.
Who Can Read Restricted Advisory Notes?
An invitation does not reveal every note.
The Malicious npm Release Had Valid Provenance Because the Build System Worked
Provenance answered where the package was built. It could not answer whether the source reaching the trusted workflow was honest.
One Malformed Photo Put OpenAI’s Private Repository Within Reach
The upload bug lived in a third-party forum. The blast radius grew because a community sign-in token carried access into employee AI accounts and GitHub.
A Departed Employee’s Token Quietly Opened 170 Private Security Repositories
The employee had left. The token had not. GitHub traced the access path back to the wider TanStack supply-chain incident.
The Fake GitHub Download Arrived With a Microsoft-Signed EDR Killer
The repositories copied more than 40 brands. The payload then used a trusted driver to remove the tools most likely to stop it.