Security

Recent

• Nov 10

  Dependabot alerts will pause on inactive repositories

  GitHub will pause Dependabot alerts on most repositories lacking activity for the past year starting December 8, 2026. Existing alerts are archived rather than deleted.

  Why it matters: Dormant repositories will stop generating security notifications, requiring teams to manually review or reactivate monitoring when resuming work on older codebases.

• Nov 10

  Someone Was Here – Find out who used your Mac while you were away

  Someone Was Here is a macOS menu bar application that captures a photo of unauthorized users using Apple Vision and Core ML. It runs locally and sends real-time remote alerts via Pushover, ntfy, Telegram, or a webhook for a one-time $4.99 lifetime purchase.

  Why it matters: Local execution via Core ML eliminates third-party telemetry, though remote alerting requires configuration with external messaging services or webhooks.

• Nov 6

  Secret scanning upgrades detectors, adds SpaceX as partner

  GitHub added SpaceX as a secret scanning partner and introduced a new detector for starlink_public_api_v2_secret. The update also upgraded existing detectors for Alibaba, AWS, Google, OpenVSX, and Pydantic Services.

  Why it matters: Expanding pattern coverage reduces exposure windows for leaked credentials across supported cloud providers and third-party services directly within the repository workflow.

• Nov 3

  Rewarding defenders with bigger bug bounties

  OpenAI raised its Security Bug Bounty rewards. The program now includes bonuses for report quality, researcher loyalty, and priority campaigns.

  Why it matters: Higher payouts and structured bonuses alter the financial incentives for independent researchers, which may accelerate vulnerability disclosure turnaround times for practitioners tracking the platform's security posture.

• Nov 2

  Security risk assessments include repository protection status

  GitHub code security risk assessments and secret risk assessments now indicate whether findings originate in protected or unprotected repositories. This distinction helps practitioners identify gaps in their security coverage across organization repositories.

  Why it matters: Practitioners can prioritize remediation efforts and systematically enforce scanning rules on unguarded codebases without manually auditing repository settings.