GitHub: receiving a security report and organizing its handling
A security report lacks version and reproduction. Learn how to organize the information, stay in touch, and choose who can read the GitHub discussion.
Category
Cybersecurity
npm: prepare the first package and validate the trust of the pipeline
The first package requires coordinating creation, archive review, and pipeline identity. Follow the trust states and the 48-hour window, then prepare rejection tests without releasing an actual package.
From pull request to npm: protecting secrets and publishing rights
Separate secrets, merge and npm publishing with GitHub rules and OIDC trusted-publishing configurations.
Copilot in JetBrains: moving from instructions to managed sandbox policies
Copilot for JetBrains gains managed sandbox policies. Prepare a pilot that checks access, exceptions and actual enforcement of the rules.
Patch window: how to reduce exposure before the patch
The time between disclosure and exploitation of a vulnerability is shrinking, while validating a patch remains non-negotiable for critical applications. Here is how to limit exposure without confusing a temporary measure with remediation.
Zero-trust AI agents: sign every write and isolate the generated code
A prompt is not a security boundary. To allow an agent to modify a system, each write must be authorized, signed, isolated, and verifiable.