Xavier Rene-Corail
@xcorail.bsky.social
Open source security at GitHub. I don’t believe in perfection, but in continuous improvement. Opinions here are mine.
Hey 👋🏾 les amis! Si vous êtes à Paris pour @devoxx.fr, passez me voir sur le stand GitHub!
GitHub Security Lab@securitylab.github.com · 4mo agoBuilding with AI? 🤖 Then you won’t want to miss tomorrow’s @devoxx.fr workshop with @xcorail.bsky.social and @jkcso.bsky.social — all about how to build robust AI-powered applications. Shall we play a Game? LLM Security in Practice m.devoxx.com/events/devox... 📍 Paris 142 🗓️ April 22, 10.30am CET
“AI is destroying my humanity.” @mitchellh.com (HashiCorp; Ghostty, Vouch). From a conversation @helen.blog and I had with him. Not an anti-AI take. A maintainer capacity take. Creation got cheaper. Review didn’t. Maintainers: what’s helped you keep mentoring sustainable?
Come say hi 👋 at DeveloperWeek.
GitHub Security Lab@securitylab.github.com · 6mo agoIf you're at #DeveloperWeek and you care about open source security, there is a session you must attend. We have been contributing to secure open source for 6 years and @xcorail.bsky.social will share with you the lessons learned from this journey! How GitHub Secures Open Source, PRO stage, 1pm.
Who knows how to secure open source better than the maintainers themselves? 🛡️
Not a Waymo forcing the passage and cutting the line in a In-n-Out drive in 🤦♂️
This is amazing. Use a SAST to detect security issues, and then triage those alerts with LLMs, to remove false positives and focus on real and exploitable issues. And of course, the framework is open source.
GitHub Security Lab@securitylab.github.com · 7mo agoLearn how we triage security alerts in GitHub Actions and JavaScript projects with the new GitHub Security Lab Taskflow Agent, and leverage LLM to focus on the exploitable vulnerabilities. github.blog/security/ai-...
🚀 GitHub is making Actions more secure by default We recently announced upcoming changes to the pull_request_target event and environment protection rules to make GitHub Actions more secure by default. We’ve opened a discussion to gather feedback 👇 🔗 github.com/orgs/communi...
Towards a secure by default GitHub Actions · community · Discussion #179107
Why are you starting this discussion? Product Feedback What GitHub Actions topic or product is this about? Workflow Configuration Discussion Details Today, GitHub announced upcoming changes to the ...
github.com
The internet was on fire. 🔥 One small library affecting billions of systems. Log4Shell was the biggest security vulnerability of all time. Now, Log4J maintainer, Christian Grobmeier tells us what it felt like inside the flames 👉 github.blog/open-source/...
“Ignorance will break all software.” Log4Shell’s one line of code broke the internet, and taught us all a lesson we can’t ignore. As Christian Grobmeier, maintainer of Log4J puts it: "Learning is the only cure for ignorance. So just keep learning."
We're taking action to make the npm supply chain stronger and harder to attack. 🛡️ Check out our plan to create a more secure future for the JavaScript community.👇 https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/
Our plan for a more secure npm supply chain
GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.
github.blog
Recent account takeovers and attacks on package registries are a wake-up call: it's time to raise the bar on authentication and secure publishing practices. Find out what npm is doing—and what steps you can take—to help secure the open source supply chain: github.blog/security/sup...
Our plan for a more secure npm supply chain
GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.
github.blog
Hey security people, if you’re in Las Vegas, say hi! If you want to talk open source security, or GitHub security products, I’d be happy to chat!
GitHub Security Lab@securitylab.github.com · last yr.Meet our team at Black Hat USA 2025 and DEF CON! At Black Hat, find us at booth #4824. Who’s attending: Xavier René-Corail – Senior Director, GitHub Security Lab Kevin Backhouse – Staff Manager, Security Research Madison Oliver – Senior Manager, Security Research Come by and say hi!
Are you at Security BSides Las Vegas? Our very own Madison Oliver is joining a panel on the evolving role of the CVE Program — from funding challenges to global coordination and new governance models. ℹ️ pretalx.com/security-bsi... 🗓️ August 5 | ⏰ 13:00–13:45 PT
This link will take you to a page that’s not on LinkedIn
lnkd.in
Anyone else going to #ossna and flight to Denver is delayed, without visibility?
If you, a business, are reliant on an open source project to function it is YOUR responsibility to assess and ensure the health of that project by either contributing to it yourself or by using an alternative if project health cannot be guaranteed.
It’s free. It’s fun. It’s easy. Learn about secure coding with the GitHub secure code game.
GitHub Security Lab@securitylab.github.com · last yr.We just launched season three of the GitHub Secure Code Game, and this time we’re putting you face to face with the security risks introduced by artificial intelligence. Get ready to learn by doing and have fun doing it! github.blog/security/hac...
Is your open source project built on a foundation of trust and security? 🛡️ Strengthen its future with essential practices like MFA, code scanning, safe dependency management, and private vulnerability reporting. 🔐 Learn how to implement these to protect your project and users with this guide. ⬇️
Security Best Practices for your Project
Strengthen your project’s future by building trust through essential security practices — from MFA and code scanning to safe dependency management and private vulnerability reporting.
opensource.guide
Season 3 of the GitHub Secure Code Game is coming — AI enters the chat 🤖🔥 Catchup with Season 1 and 2 at gh.io/secure-code-game
Star Wars has released one hour of Mon Mothma dancing. #Andor www.youtube.com/watch?v=y6wL...
ONE HOUR OF DANCING MON MOTHMA | Andor Season 2 | Disney+
YouTube video by Star Wars
youtube.com
Finally watched the first episode of The Studio. OMG this is hilarious. I must admit I had a hard time with the disrespect of my hero Marty … I’ll get over it, but it was a difficult moment.
In this demonstration I show the impact of CVE-2025-25291/CVE-2025-25292, an authentication bypass in ruby-saml used by high profile OSS projects such as GitLab. My team coordinated with both the ruby-saml maintainer and GitLab to get this vulnerability fixed and patches are available at gh.io/glfx
Happy Friday folks! Here is a throwback to our 2nd most popular research post of 2024, "Gaining kernel code execution on an MTE-enabled Pixel 8" by Man yue Mo github.blog/security/vul...
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulne...
github.blog
Sure, chocolates are nice and all but why not show your favourite open source projects how much you love them by sponsoring them today! github.blog/open-source/...
Support the open source projects you love this Valentine’s Day
You can help provide much-needed support to the critical but often underfunded projects that keep your infrastructure running smoothly.
github.blog
Don’t just say DEI as if it’s a bad word. Spell it out. Say diversity, which is the lifeblood of American society & culture & innovation. Say equity, which a just society should pursue. Say inclusion, because decent people believe in increasing belonging, not isolating people who are different.
Security researchers are digital detectives, safeguarding the internet by uncovering vulnerabilities. 🔍 Start your journey in cybersecurity research today. ⬇️ github.blog/security/vul...
Cybersecurity researchers: Digital detectives in a connected world
Discover the exciting world of cybersecurity research: what researchers do, essential skills, and actionable steps to begin your journey toward protecting the digital world.
github.blog
Hello from the GitHub Security Lab! We are a team of security experts who cultivate a collaborative community where developers and security professionals come together to secure open source software.
