github
Safeguard articles tagged "github" — guides, analysis, and best practices for software supply chain and application security.
30 articles
Dependabot vs Renovate: Which Dependency Update Bot Should You Use?
A practical guide comparing Dependabot and Renovate for automated dependency updates, covering configuration flexibility, ecosystem support, and team workflows.
Slack GitHub Repository Theft: Stolen Tokens and the Risks of Third-Party Integrations
In December 2022, Slack disclosed that stolen employee tokens were used to access private GitHub repositories. The breach highlighted the risks of token-based authentication in CI/CD pipelines.
GitHub Repository Security Settings Guide
Configure GitHub repository security settings for branch protection, secret scanning, dependency alerts, and code scanning.
GitHub Code Signing Bypass: When the Trust Anchor Fails
A vulnerability in GitHub's commit signature verification allowed attackers to forge signed commits. The flaw undermined the integrity guarantees that code signing is supposed to provide.
Setting Up Dependency Scanning on GitHub
A hands-on walkthrough for configuring automated dependency scanning in your GitHub repositories, from Dependabot alerts to custom CI workflows.
The GitHub Codespaces Security Model, Examined
GitHub Codespaces has gone GA and is about to become the dev environment standard. Here is a close read of its security model — including what it does not solve.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.