The Security Sync: What’s New in Code Security 🤖

[ghostinhershell]

Hey hey! 👋 Reporting in for a Code Security Community Check-In 🗞

Community Updates

We’ve got some community shoutouts to give, questions that need the community to answer, updates on what’s new in the Code Security space and great reads to get those creative juices flowing 📖

🤖Code Security Shoutouts

• A self-serve win is always a win, especially when the community member worked out the solution “out loud”. Shout out to @stephenegriffin for finding a solution to the roadblock they ran into with Rule tags in SARIF file exceeding limits.
• @ThisIs-Developer (check out their project spotlight here) lent community members a hand with an answer to the post Could not get my account lmysticl.
• Shout out to @MuxN4 for teaching us how floating-point numbers are represented in binary

Have you been helped by a community superstar that you’d like to see celebrated? Tag them to nominate them below!

For community members who post questions, marking responses that solves your question as the answer goes a long way. When you mark a comment in the Discussion as an answer, GitHub will highlight the comment to help other community members quickly find the answer as well.

Remember to thank these and other community members that take the time to comment and help troubleshoot these problems. An acknowledgement of a job well done can have an incredible effect and make someone’s day. ☀️ We’re here to learn, discover and connect so try and mark a comment as an answer if suitable, give a thank you and select a reaction as a way to show your appreciation!

🧠 Help Wanted! Questions that Need Answers

Got your thinking cap on? These popular community posts could use your expertise!

• Removing an archived repository from code scanning alerts view / list
• I have changed my passkey on windows and cant use the same name, is it a bug or potential a risk?
• Can we (or when might we be able to) add dependabot and secret scanning alerts to campaigns.

🆕 What’s New in Code Security?

Stay ahead in the world of secure development with our latest advancements. From enhanced vulnerability detection to improved threat mitigation tools, these updates are designed to safeguard your code, streamline your workflows, and empower developers to build confidently.

• Upcoming changes to data retention for Events API, Atom feed, /timeline and /dashboard-feed features
• Copilot Autofix for Dependabot now available for TypeScript repositories (private preview)
• New PAT rotation policies preview and optional expiration for fine-grained PATs

A number of feedback posts have been published in the community for recent releases in the GitHub Security World. Have you seen them?

• Secret scanning: on-demand revocation for GitHub personal access tokens - feedback
• Secret scanning: public leak locations and alert de-duplication across an organization or enterprise - feedback
• Secret Scanning & Security Dashboard Updates 📢
• EPSS Scores in the GitHub Advisory Database 🚀
• CodeQL 2.19.0: TypeScript 5.6 and Go 1.23 support, new queries for JavaScript and Ruby
• Announcing TISAX for GitHub 🚀

Please check them out and, if you have any feedback to share, sound off in the comments section of the applicable post.

✍️ Quote of the Month

Any problem can be solved by investing more heavily into it, but there’s always a more efficient solution. If you’re convinced that you must surge investment, check if your mental model is leading you astray. _
From Move past incident response to reliability by Will Larson, CTO, Calm
—--

A very big thank you to everyone in the community who actively contributes thoughts and answers to the questions that come into the New to GitHub category!

[rubikproxy]

Hey hey! 👋

Thank you for the insightful Code Security Community Check-In! It's fantastic to see the community's dedication to enhancing code security and supporting each other. Here's my response:

Community Shoutouts:
Kudos to @stephenegriffin, @ThisIs-Developer, and @MuxN4 for their valuable contributions! Their solutions and explanations exemplify the collaborative spirit of our community. Let's continue to share knowledge and assist one another. 🌟

Marking Responses as Answers:
I wholeheartedly agree—marking helpful responses as answers not only aids the original poster but also helps others find solutions more efficiently. It's a simple yet impactful way to maintain an organized and resourceful community. Let's make this a common practice! ✔️

Help Wanted! Questions:
The "Help Wanted" section is a great initiative to highlight unanswered questions. I'll be sure to check out these topics and contribute where I can. Let's keep the momentum going and help each other grow! 🤝

What’s New in Code Security:
The new features, like Copilot Autofix for Dependabot and the fine-grained PAT rotation policies, sound like game-changers! They promise to make secure development not only more effective but also more seamless for developers. I'm especially interested in the EPSS Scores in the GitHub Advisory Database—can't wait to explore how this helps prioritize vulnerabilities!

Feedback on Recent Updates:
I appreciate GitHub's commitment to continuous improvement. I'll make sure to share my thoughts on Secret Scanning and other updates that are helping to level up code security.

Quote of the Month:
The quote is a great reminder to focus on finding efficient solutions rather than just throwing resources at a problem. It's something we can all reflect on, especially when tackling challenges in development and security. 💡

Thanks again to the GitHub team and community for fostering such a vibrant and innovative space. Let's continue to learn, connect, and make the world of development more secure, one step at a time! 🛡️✨

• The GitHub Blog
• The GitHub Blog
• The GitHub Blog