Tag: GitHub security
Secrets Sprawl and Rotation: A Practical Vault Management Playbook
Oreoluwa Omoike | | AI security, AI-assisted coding, API Key Security, AWS Secrets Manager, Azure Key Vault, CI/CD security, Cloud Security, credential exposure, Credential Rotation, Data Breaches, devsecops, Dynamic Secrets, GitGuardian, GitHub security, Google Secret Manager, hardcoded secrets, HashiCorp Vault, least-privilege, MCP Security, Model Context Protocol, non-human identities, secrets management, secrets sprawl, Security Boulevard, Terraform securityIn 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year jump the company has ...
A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token
Canio Campaniello | | AI agent security, command injection, credential security, GitHub security, least-privilege, OpenAI CodexAI coding agents don't just suggest code anymore. Tools like OpenAI's Codex spin up a real container, clone a real repository, and authenticate with a real GitHub credential to get the job ...
GitHub Separates Who Writes Code From Who Runs Your CI
Tom Smith | | Actions security, CI/CD security, devops, devsecops, github, GitHub Actions, GitHub Enterprise, GitHub security, pipeline security, pull_request_target, Repository Security, Software Supply Chain, supply chain security, workflow execution protections, workflow securityGitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security ...
GitHub Widens the Door on Advanced Security Trials
Tom Smith | | AI coding, application security, CodeQL, Developer Security, devsecops, exposed credentials, GHAS, GitHub Advanced Security, GitHub Code Security, GitHub Enterprise Cloud, GitHub Secret Protection, GitHub security, mid-market security, Repository Security, secret scanning, secure software development, Software Supply Chain Security, vulnerability scanningGitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free ...
Cyber Threats to DevOps Platforms Rising Fast, GitProtect Report Finds
Jeff Burt | | Azure DevOps, CI/CD, code repositories, Cybersecurity, DevOps platform downtime, devops security, extortion, GitHub security, GitProtect.io DevOps Threats report, GPUGate, JIRA, Kaspersky Lab, NPM security, Ransomware, Shai-HuludThe number of incidents targeting DevOps platforms grew 21% in 2025, but the amount of downtime jumped almost 95%, the security firm said ...
AWS CodeBuild Webhook Misconfiguration Exposed Admin Access Risk
Tom Smith | | AWS CodeBuild, AWS open source, build pipeline security, CI/CD security, devops security, GitHub security, regex security, Software Supply Chain, webhook misconfiguration, Wiz ResearchAWS fixed webhook filter misconfigurations in CodeBuild that could have allowed unauthorized repository access. No customer impact or malicious code found ...
