Xavier Rene-Corail

🚀 GitHub is making Actions more secure by default

We recently announced upcoming changes to the pull_request_target event and environment protection rules to make GitHub Actions more secure by default.

We’ve opened a discussion to gather feedback 👇

🔗 github.com/orgs/communi...

The internet was on fire. 🔥
One small library affecting billions of systems.
Log4Shell was the biggest security vulnerability of all time.

Now, Log4J maintainer, Christian Grobmeier tells us what it felt like inside the flames 👉 github.blog/open-source/...

“Ignorance will break all software.”

Log4Shell’s one line of code broke the internet, and taught us all a lesson we can’t ignore. As Christian Grobmeier, maintainer of Log4J puts it: "Learning is the only cure for ignorance. So just keep learning."

Oh, congrats Kara!

a woman in a striped coat is standing in front of a man ALT: a woman in a striped coat is standing in front of a man

😭

Our plan for a more secure npm supply chain GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.

We're taking action to make the npm supply chain stronger and harder to attack. 🛡️

Check out our plan to create a more secure future for the JavaScript community.👇
https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

Our plan for a more secure npm supply chain GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.

Recent account takeovers and attacks on package registries are a wake-up call: it's time to raise the bar on authentication and secure publishing practices. Find out what npm is doing—and what steps you can take—to help secure the open source supply chain: github.blog/security/sup...

Yay!

a close up of a man with the words we come far Alt: a close up of a dialogue between Greene and Costner in “Dance with wolves”: Greene: we come far you and me - Costner: I will not forget you

RIP Graham Greene.

When we see your smile for 2001 vs. Twilight, we know what the final result will be 😂

Hey security people, if you’re in Las Vegas, say hi!
If you want to talk open source security, or GitHub security products, I’d be happy to chat!

Are you at Security BSides Las Vegas?

Our very own Madison Oliver is joining a panel on the evolving role of the CVE Program — from funding challenges to global coordination and new governance models.

ℹ️ pretalx.com/security-bsi...
🗓️ August 5 | ⏰ 13:00–13:45 PT

Anyone else going to #ossna and flight to Denver is delayed, without visibility?

Throw them a volleyball and see what happens. We need to know.

If you, a business, are reliant on an open source project to function it is YOUR responsibility to assess and ensure the health of that project by either contributing to it yourself or by using an alternative if project health cannot be guaranteed.

I am curious now … which one?

It’s free. It’s fun. It’s easy.
Learn about secure coding with the GitHub secure code game.

Depends. It would take me too long to arrive … I would make long pauses on the grass!

Security Best Practices for your Project Strengthen your project’s future by building trust through essential security practices — from MFA and code scanning to safe dependency management and private vulnerability reporting.

Is your open source project built on a foundation of trust and security? 🛡️

Strengthen its future with essential practices like MFA, code scanning, safe dependency management, and private vulnerability reporting. 🔐

Learn how to implement these to protect your project and users with this guide. ⬇️

Season 3 of the GitHub Secure Code Game is coming — AI enters the chat 🤖🔥
Catchup with Season 1 and 2 at gh.io/secure-code-game

It’s a long time wish. I remember when he was invited by Macron to the French military parade (Bastille day) in 2017 he said he wanted to do a similar parade in the US.

So relatable. Thank you Ashley ❤️

YouTube video by Star Wars ONE HOUR OF DANCING MON MOTHMA | Andor Season 2 | Disney+

Star Wars has released one hour of Mon Mothma dancing. #Andor www.youtube.com/watch?v=y6wL...

Agree. I think the best (worst?) episodes are when the plot is so plausible.

There is one sentence in all this non-sense that I agree with: « this film has to happen » - please DO IT!

Finally watched the first episode of The Studio. OMG this is hilarious. I must admit I had a hard time with the disrespect of my hero Marty … I’ll get over it, but it was a difficult moment.

a man with a mustache wearing a cowboy hat and saying say when ALT: a man with a mustache wearing a cowboy hat and saying say when

So … Heat or Tombstone tonight? 😢 RIP Val Kilmer

In this demonstration I show the impact of CVE-2025-25291/CVE-2025-25292, an authentication bypass in ruby-saml used by high profile OSS projects such as GitLab. My team coordinated with both the ruby-saml maintainer and GitLab to get this vulnerability fixed and patches are available at gh.io/glfx

Alright but can you bring your image out of the room, or does it get wiped out in the elevator?

Does your outie code work on your innie’s machine?