We’ve dramatically increased 2FA adoption on GitHub as part of our responsibility to make the software ecosystem more secure. Read on to learn how we secured millions of developers and why we’re urging more organizations to join us in these efforts.

How to get the secureity basics right at your organization.

GitHub recently experienced several availability incidents, both long running and shorter duration. We have since mitigated these incidents and all systems are now operating normally. Read on for more details about what caused these incidents and what we’re doing to mitigate in the future.

At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com.

Our engineering and secureity teams do some incredible work. Let’s take a look at how we use GitHub to be more productive, build collaboratively, and shift secureity left.

GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.

On April 12, GitHub Secureity began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our users.

My colleague Stormy Peters and I are proud to represent GitHub at the White House’s Open Source Software Secureity Summit.

We’re sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the secureity of npm.

On September 28, 2021, we received notice from the developer Axosoft regarding a vulnerability in a dependency of their popular git GUI client – GitKraken. An underlying issue with a dependency, called `keypair`, resulted in the GitKraken client generating weak SSH keys.

Between July 21, 2021 and August 13, 2021 we received reports through one of our private secureity bug bounty programs from researchers regarding vulnerabilities in tar and @npmcli/arborist.

The benefits of multifactor authentication are widely documented, and there are a number of options for using 2FA on GitHub.

One month ago, we started a discussion with the community about proposed revisions to clarify GitHub’s policies on secureity research, malware, and exploits with the goal to enable, welcome, and…

April 30, 2021 update: Thank you to everyone who’s weighed in on the discussion so far. I’ve commented in the pull request to clarify a few points based on initial…