Mastodawn

Sign in with ANY password: How we used AI to break into a popular chat application, and other high-impact vulnerabilities. Read "How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework" https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/

How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework

GitHub Security Lab Taskflow Agent is very effective at finding Auth Bypasses, IDORs, Token Leaks, and other high-impact vulnerabilities.

The GitHub Blog

GitHub Security Lab Mar 6

Hello hackers! Here are our February bug bounty stats!

🐛 200 bounty reports submitted
👩‍💻 144 hackers participated in our program
💰 Awarded $48,589 in bounties

Found a vulnerability? Submit it here:
https://t.co/HG2AqybW0p

GitHub Security

Bug Bounty Program

GitHub Bug Bounty

GitHub Security Lab Feb 19

If you're at #developeweek and you care about open source security, there is a session you must attend. The GitHub Security Lab has been contributing to secure open source for the past 6 years and Xavier Rene-Corail / @xcorail will share with you the lessons learned from this journey! How GitHub Secures Open Source, PRO stage, 1pm.

GitHub Security Lab Feb 9

Here are our January bug bounty stats!
🐛 182 bounty reports submitted
👩‍💻 112 hackers participated in our program
💰 Awarded $76,269 in bounties
Found a vulnerability? Submit it here: https://t.co/HG2AqybW0p.

GitHub Security

Bug Bounty Program

GitHub Bug Bounty

GitHub Security Lab Jan 20

Learn how we triage security alerts in GitHub Actions and JavaScript projects with the new GitHub Security Lab Taskflow Agent, and leverage LLM to focus on the exploitable vulnerabilities. https://github.blog/security/ai-supported-vulnerability-triage-with-the-github-security-lab-taskflow-agent/

AI-supported vulnerability triage with the GitHub Security Lab Taskflow Agent

Learn how we are using the newly released GitHub Security Lab Taskflow Agent to triage categories of vulnerabilities.

The GitHub Blog

GitHub Security Lab Jan 14

Excited to share our open source agentic framework for security research, a collaborative framework that lets the community share AI "taskflows”! Read @kevinbackhouse 's blog post for details and a demo. Join us in strengthening open-source security! https://github.blog/security/community-powered-security-with-ai-an-open-source-framework-for-security-research/

Community-powered security with AI: an open source framework for security research

Announcing GitHub Security Lab Taskflow Agent, an open source and collaborative framework for security research with AI.

The GitHub Blog

GitHub Security Lab Jan 6

We wrapped up 2025 on a high note—here are the bug bounty stats for December!
✅ 151 bounty reports submitted
👥110 hackers participated in our program
💰Awarded $48,367 in bounties

Found a vulnerability? Submit it here: https://bounty.github.com.

GitHub Security

Bug Bounty Program

GitHub Bug Bounty

GitHub Security Lab Dec 30

Learn why some vulnerabilities resist to fuzzing and persist in long-enrolled OSS-Fuzz projects, and how you can find them!

https://github.blog/security/vulnerability-research/bugs-that-survive-the-heat-of-continuous-fuzzing/

GitHub Security Lab Dec 23

In just 17 minutes, 📌 Jaroslav Lobačevski shares his knowledge about securing GitHub Actions, drawing from hands-on experience uncovering hundreds of real-world vulnerabilities.

Topics include:
• Best practices of using third party actions
• The security model of GitHub Actions: tokens and permissions, jobs isolation and secrets
• pull_request vs pull_request_target
• Common pitfalls that lead to Remote Code Execution (RCE): interpolation and environment injections, cache poisoning
• …and more

The talk wraps up with FREE tools to automate GitHub Actions security you can start using TODAY.

https://gh.io/secure-github-actions

Resources

Securing open source software, together.

GitHub Security Lab

GitHub Security Lab Dec 23

GitHub Security Lab discovered a critical vulnerability in WooCommerce. We’d like to thank WooCommerce/Automattic for their incredibly quick response and fix of the vulnerability.

“A critical vulnerability was discovered in WooCommerce (versions 8.1 to 10.4.2) that, if exploited, could allow logged-in customers to access order details belonging to guest customers.”

If you are using WooCommerce, please update. For more info see WooCommerce’s blog post:
https://developer.woocommerce.com/2025/12/22/store-api-vulnerability-patched-in-woocommerce-8-1/

Store API Vulnerability Patched in WooCommerce 8.1+ - What You Need To Know

A critical vulnerability in WooCommerce 8.1+ has been patched. We strongly recommend updating immediately.

The WooCommerce Developer Blog