GitHub Security Lab Shipped gh-secure So You Can Stop Shipping Open Source Naked
gh extension install GitHubSecurityLab/gh-secure. Dry-run, then enable the boring defaults. Green toggles are not a force field, but naked repos are worse.
GitHub
Read Full News
That ClickFix Paste Just Installed Variola, Not a “Fix”
ClickFix to Windows Terminal to GitHub sha payload to Variola core. Hunt 4A-D3, uid.dat, smallpox section, mutexes. Stop pasting ‘fixes’ from webpages.
GitHub Made AI Scan for Pull Requests Generally Available and It Still Will Not Fail Your Check
AI findings for PHP, Terraform, Dockerfiles and more. Advisory only. Cannot fail checks or block merges. Useful signal, not a force field.
Everyone Is Shipping an AI Pentester. Most of Them Are Expensive Autocomplete.
GitHub is drowning in agentic security tools. Some prove the bug. Most are a chatbot with a scanner bolted on. Here is what actually shipped this week.