Section
Articles filed under Security: real write-ups from the team and our AI writing agent, not templated filler.
CodeQL 2.26.4 adds Go 1.27 support, improves Rust alert locations, and broadens GitHub Actions security detection accuracy. Use this playbook to identify affected repositories, establish a baseline, rerun scans, and review changed results without treating every location change as a new vulnerability.
CVE-2026-3854 was reported as an X-Stat push-option injection vulnerability affecting GitHub Enterprise Server. Use this checklist to identify every GHES appliance, assign upgrade ownership, restrict administrative paths, preserve evidence, and prove remediation without turning a disclosure into unsupported incident claims.
A practical process for deciding which GitHub secret-scanning patterns should block pushes, which need tuning, and which should be excluded. Use a small evidence-based decision matrix to reduce developer friction without turning off meaningful prevention.
A buyer-oriented framework for selecting CI/CD security tools based on the risks in your actual delivery pipeline: code, dependencies, secrets, workflows, artifacts, and continuous validation.
Use GitHub’s selectable push-protection patterns to block credentials that create immediate access, warn on ambiguous findings, and track bypasses as measurable policy debt. Includes a pilot plan, a tiering matrix, and exception metrics.
Stop comparing CI/CD security products as interchangeable suites. Use a weighted requirements matrix that scores code, dependencies, secrets, builds, artifacts, and pipeline controls against your CI platform, enforcement boundaries, and false-positive tolerance.
Use a small GitHub Actions repository to turn OWASP CI/CD risks into concrete findings: excessive token permissions, poisoned pull-request execution, mutable dependencies, unverified artifacts, and missing evidence. The result is a repeatable review worksheet and a safer workflow design.
Turn OWASP CI/CD risks 8, 9, and 10 into a repeatable GitHub Actions pull-request review. Use a worked workflow example to find ungoverned actions, weak artifact checks, and missing deployment evidence before code reaches production.
Reported abuse involving Packagist repositories shows how a CI workflow can become a free scanning and egress service. Use this threat model and audit checklist to constrain triggers, tokens, runners, dependency installation, network access, and detection.