A look at the targeted AI taskflows behind these findings, the bugs they uncovered, and how to run the same open-source agent on your own app.

In this blog post, I explain how to use the new fuzzing taskflow based on the GitHub Security Lab Taskflow Agent AI framework.

These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors.

A GitHub CLI extension to enable security features on repositories following best practices from GitHub Security Lab. - GitHubSecurityLab/gh-secure

Bug Bounty Program

OpenClaw is the fastest-growing project in GitHub history. Some of its maintainers share what they learned in the project's first six months.

See how the projects in the GitHub Secure Open Source Fund combined AI-assisted workflows, maintainer expertise, and more to improve project security.

Bug Bounty Program

GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience.

Learn how to find security vulnerabilities at Introduction to security research. Find a CVE with CodeQL tutorial

These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors.

BSides Vilnius 2026 — community-driven cybersecurity conference in Lithuania. Workshops, talks, and CTF on 3–4 June at Kablys. Join the infosec community.

The largest expo conference for software developers and IT professionals in Romania, gathering over 8000 participants from all over the world.

Sesja Linuksowa to największa w Polsce konferencja poświęcona Wolnemu Oprogramowaniu oraz najnowszym trendom w systemach z rodziny GNU/Linux.

Your ultimate companion for Devoxx conferences worldwide. Browse talks, speakers, schedules, and manage your personalized conference experience.

Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

Learn to find and exploit real-world agentic AI vulnerabilities through five progressive challenges in this free, open source game that over 10,000 developers have already used to sharpen their securi...

Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

Versions >= v6.38.0 and < v8.4.2 of the website flavor of Signal for Android (distributed at https://signal.org/android/apk) allows another installed app without any permissions to exfiltrate decrypte...

Signal for Android versions >= v8.1.0 and < v8.3.0 are affected by a vulnerability where an attacker can exploit improperly validated group context within the Admin Delete message handler, leading to ...

Signal for iOS v8.2 is affected by a vulnerability where an attacker can exploit an improper authorization check within the Admin Delete message handler, leading to unauthorized message deletion.

Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed.

A look at GitHub Actions’ 2026 roadmap, outlining how secure defaults, policy controls, and CI/CD observability harden the software supply chain end to end.

Dear open source community, On March 20th GitHub learned of a new supply chain attack through public disclosure by socket.dev dubbed CanisterWorm that affects more than 64 unique npm packages.

GitHub Security Lab Taskflow Agent is very effective at finding Auth Bypasses, IDORs, Token Leaks, and other high-impact vulnerabilities.

Learn how we are using the newly released GitHub Security Lab Taskflow Agent to triage categories of vulnerabilities.

Announcing GitHub Security Lab Taskflow Agent, an open source and collaborative framework for security research with AI.

Bug Bounty Program

Securing open source software, together.

Securing open source software, together.

A critical vulnerability in WooCommerce 8.1+ has been patched. We strongly recommend updating immediately.