GitHub Copilot can now operate desktop apps, not just code
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
Search
Search results for “Git history security”
Find published research by company, product, platform or technology.
Showing 41–60 of 326 dossiers
GitHub adds credential inventory to its selective incident-response kill switches
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
GitHub rewrote Copilot’s 800,000-line agent runtime in Rust with agents doing most of the coding
The useful part is not the 800,000-line headline. GitHub has published unusually detailed receipts for a production-scale agent-assisted migration: roughly $120,000 of token spend, 14.5 weeks of incremental releases, dozens of regressions, extensive compatibility tests and a workload-specific jump from 7.55 to 120 session lifecycles per second.
GitHub Actions can now block who or what starts a workflow — and `pull_request_target` is getting a secure default
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
GitHub Actions is moving `ubuntu-latest` to Ubuntu 26.04 — test before October 19
GitHub-hosted Actions jobs that use `ubuntu-latest` are about to change operating-system generation without a YAML edit; teams can test on `ubuntu-26.04` now or pin 24.04 while they migrate.
GitHub AI Scan no longer needs CodeQL default setup
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
GitHub Copilot Auto now lets developers choose whether routing optimizes for cost or intelligence
The material change is that model routing is no longer a single opaque optimization target. Developers can now tell Copilot whether to bias Auto toward lower cost, a middle ground or higher quality while GitHub still chooses a model prompt by prompt.
GitSpawn shows how a repository’s own Git config can escape AI coding-agent safety boundaries
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
GitHub Spark is shutting down August 31 — export code now and replace broken `llm()` calls
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
GitHub Actions makes cache access a least-privilege workflow permission
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
GitHub can now make unresolved secret leaks a hard pull-request merge blocker
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI CodingDeployment & DevOpsDeveloper ToolsActive dossier
GitHub Enterprise Server 3.22 brings Copilot CLI into disconnected and air-gapped environments
The technical-preview feature separates Copilot CLI from GitHub Cloud for core coding, shell and repository workflows, giving regulated and isolated environments a supported agent path while leaving cloud-dependent capabilities such as GitHub-hosted model selection and web search unavailable.
GitHub Copilot code review can now approve pull requests
Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.
GitHub Copilot turns Slack and Teams conversations into shared coding-agent sessions
GitHub Copilot can now turn Slack or Teams threads into collaborative cloud-agent sessions. Teammates can add context and steer the work in public, while repository permissions, agent budgets and optional extra PR approvals remain the main control boundaries.
GitHub’s OAuth apps get short-lived tokens, multiple callbacks — and a wildcard setting worth auditing
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
GitHub is turning agent confidence into a workflow control for Issues
GitHub Issues now gives agent automations confidence levels, rationales and optional approvals, letting teams automate routine triage while holding uncertain changes for review.
Homebrew 7.0 turns package vulnerability checks into a built-in workflow — after closing a sudo-capable cask flaw
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
Northflank traces October secret exposure to hours before its first alert; key rotation remains urgent
Northflank clarifies the October 30 secret-exposure window and alert-to-patch timeline; an affected customer confirms database credentials were at risk, although its own logs show no unauthorised access.
Coolify 4.7.3 adds deployment cancellation, SSH host-key checks and image vulnerability scanning after 4.5
Coolify 4.7.0–4.7.3 adds automatic cancellation of old queued webhook deployments, tighter API/SSH security and vulnerability scanning, with follow-up access fixes.
FrankenPHP 1.13.5 patches 17 flaws, including uploaded-file PHP execution
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.