GitHub: receiving a security report and organizing its handling
A security report lacks version and reproduction. Learn how to organize the information, stay in touch, and choose who can read the GitHub discussion.
Topic
GitHub
npm: prepare the first package and validate the trust of the pipeline
The first package requires coordinating creation, archive review, and pipeline identity. Follow the trust states and the 48-hour window, then prepare rejection tests without releasing an actual package.
GitHub Apps: do your integrations accept the new tokens?
A longer secret can break an integration even when its permissions remain unchanged. Follow a GitHub App token from storage to the request and prepare transport and masking tests with dummy values.
From pull request to npm: protecting secrets and publishing rights
Separate secrets, merge and npm publishing with GitHub rules and OIDC trusted-publishing configurations.