GitHub Security Lab Shipped gh-secure So You Can Stop Shipping Open Source Naked
gh extension install GitHubSecurityLab/gh-secure. Dry-run, then enable the boring defaults. Green toggles are not a force field, but naked repos are worse.
GitHub Tools
Read Full News
GitHub Made AI Scan for Pull Requests Generally Available and It Still Will Not Fail Your Check
AI findings for PHP, Terraform, Dockerfiles and more. Advisory only. Cannot fail checks or block merges. Useful signal, not a force field.
GitHub Security Lab Open-Sourced an LLM That Babysits AFL++ So You Do Not Have To
Point it at owner/repo, get harnesses, coverage loops, and review-required vulnerability reports. Disposable VM required. Blind merges forbidden.
Everyone Is Shipping an AI Pentester. Most of Them Are Expensive Autocomplete.
GitHub is drowning in agentic security tools. Some prove the bug. Most are a chatbot with a scanner bolted on. Here is what actually shipped this week.