GitHub Security Lab’s mission is to inspire and enable the community to secure the open source software we all depend on.
Joined October 2019
- Tweets 1,453
- Following 15
- Followers 26,603
- Likes 190
215 Photos and videos
Pinned Tweet
14 Feb 2025
Find the GitHub Security Lab now on LinkedIn, Mastodon and Bluesky! 👇
7
7
8
7,279
14 Feb 2025
Find the GitHub Security Lab now on LinkedIn, Mastodon and Bluesky! 👇
7
7
8
7,279
23 Jan 2025
GHSL-2024-323: Denial of Service (DoS) in snapcraft securitylab.github.com/advis…
5
5
5
3,029
23 Jan 2025
GHSL-2024-296: Deserialization of untrusted data in Kykms securitylab.github.com/advis…
2
7
1,982
23 Jan 2025
GHSL-2024-273: ReDoS in remove_html_tags of Gradio securitylab.github.com/advis…
1
9
1,507
GitHub Security Lab retweeted
22 Jan 2025
Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵
7
80
296
30,460
16 Jan 2025
GHSL-2024-327: Poisoned Pipeline Execution (PPE) in Microsoft FluentUI securitylab.github.com/advis…
1
1
7
1,529
16 Jan 2025
GHSL-2024-254: Poisoned Pipeline Execution (PPE) in Amplification leading to potential acccount takeover securitylab.github.com/advis…
3
10
1,308
9 Jan 2025
How to secure your GitHub Actions workflows with CodeQL. Dive into this actionable supply chain security research from @pwntester . This work resulted in dozens of high impact supply chain findings and, most importantly, added CodeQL support for your GitHub workflows! github.blog/security/applica…
6
15
53
5,723
GitHub Security Lab retweeted
30 Dec 2024
Ever wanted to learn fuzzing?!?! 🐛 Me and some other folks at @pbrucla recently ran a project where we taught folks about the basics of fuzzing with Honggfuzz. 👀 Some fun activities inspired by the Fuzzing101 repo from the folks at @GHSecurityLab! 🤗
github.com/pbrucla/fuzzing-l…
3
54
247
13,493
9 Jan 2025
GHSL-2024-303: Code execution in trusted context via a GitHub Action of Tribler securitylab.github.com/advis…
1
8
1,002
27 Dec 2024
GHSL-2024-173: Environment Variable injection in a Feign GitHub Actions workflow securitylab.github.com/advis…
1
6
1,274
23 Dec 2024
🎉 Excited to announce the launch of CodeQL Community Packs for Security teams and researchers!
🚀 Supercharge your code analysis with new Query, Model, and Library packs, to find more vulnerabilities, accelerate codebases audit, and secure code effortlessly.
github.blog/security/vulnera…
1
12
39
4,991
19 Dec 2024
GHSL-2024-091_GHSL-2024-092: DNS rebinding attacks against Home-gallery - CVE-2024-53275, CVE-2024-53276
securitylab.github.com/advis…
1
2
9
1,314
19 Dec 2024
GHSL-2024-075_GHSL-2024-076: Stored Cross-Site Scripting (XSS) and Remote Code Execution (RCE) via Velocity Template Evaluation in Sonatype Nexus 2
securitylab.github.com/advis…
1
11
1,134
19 Dec 2024
GHSL-2024-072_GHSL-2024-074: Stored Cross-Site Scripting (XSS), Arbitrary File Upload, and Arbitrary File Read/Write via Path Traversal in Reposilite - CVE-2024-36115, CVE-2024-36116, CVE-2024-36117
securitylab.github.com/advis…
1
5
878
A new free tier of GitHub Copilot in @code.
✅ 2,000 code completions per month
💬 50 chat messages per month
💫 Models like Claude 3.5 Sonnet or GPT-4o
♥️ More fun for you
Check it out today!
Oh yeah, and we passed 150M developers on GitHub 💅 github.blog/news-insights/pr…
106
624
2,645
3,081,464
18 Dec 2024
🎉 You can now enable code scanning in your GitHub Actions workflow files!
✅ By opting-in to this feature, you can enhance the security of repositories using GitHub Actions.
github.blog/changelog/2024-1…
7
18
5,635