Blogs about SCMs

Legitify adds support for GitLab and GitHub Enterprise Server

Legitify is an open-source GitHub and GitLab configuration scanner from Legit Security that helps manage & enforce SCM configuration best practices in a secure and scalable way

New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.

Threats SCMs

Novel Pipeline Vulnerability Discovered; Rust Found Vulnerable

New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.

Legitify is an open-source GitHub configuration scanner from Legit Security that helps manage & enforce GitHub configurations in a secure and scalable way

Legit SCMs

Introducing Legitify: A Better Way To Secure GitHub

Legitify is an open-source GitHub configuration scanner from Legit Security that helps manage & enforce GitHub configurations in a secure and scalable way

GitHub configurations aren't secure out of the box. It's up to you to secure them. This blog discusses GitHub's new Codespaces product and how to secure it.

Best Practices SCMs

GitHub Codespaces Security Best Practices

GitHub configurations aren't secure out of the box. It's up to you to secure them. This blog discusses GitHub's new Codespaces product and how to secure it.

GitHub’s required reviewers capability can be bypassed if currently using this setting to require at least one code review before merging code.

Threats SCMs

Attackers Can Bypass GitHub Required Reviewers to Submit Malicious Code

GitHub’s required reviewers capability can be bypassed if currently using this setting to require at least one code review before merging code.

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

Legit Threats SCMs

Google & Apache Found Vulnerable to GitHub Environment Injection

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

Earlier today, Stephan Lacy published a Twitter post about a massive attack on GitHub. Even though later it was understood that none of the original GitHub repositories was infected, the attack attempt is a huge deal.

Threats SCMs

Breaking News: How a Massive Malware Attack Almost Occurred on GitHub

Earlier today, Stephan Lacy published a Twitter post about a massive attack on GitHub. Even though later it was understood that none of the original GitHub repositories was infected, the attack attempt is a huge deal.

GitHub makes it easy for developers to collaborate, but it’s also easy for bad actors to exploit misconfigurations and vulnerabilities.

Best Practices SCMs

Securing GitHub: How to Keep Your Code and Pipelines Safe from Hackers

GitHub makes it easy for developers to collaborate, but it’s also easy for bad actors to exploit misconfigurations and vulnerabilities.

This article will explain why security and GitHub should go hand in hand and describes a few best practices we believe any organization using GitHub should employ to reduce GitHub security risks.

Best Practices SCMs

GitHub Security Best Practices Your Team Should Be Following

This article will explain why security and GitHub should go hand in hand and describes a few best practices we believe any organization using GitHub should employ to reduce GitHub security risks.

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Best Practices Legit Threats SCMs

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

This GitHub OAuth access token attack was announced by GitHub Security and is a compromise of OAuth access tokens issued to Heroku and Travis-CI integrations.

Explainers Threats SCMs

Latest GitHub OAuth Tokens Attack Explained and How to Protect Yourself

This GitHub OAuth access token attack was announced by GitHub Security and is a compromise of OAuth access tokens issued to Heroku and Travis-CI integrations.

On April 1st, GitLab announced Critical Security Release CVE-2022-1162, disclosing a very bizarre vulnerability and illustrating some important lessons in securing a software supply chain.

Threats SCMs

A Cautionary Tale: The Untold Story of the GitLab CVE Backdoor (CVE-2022-1162)

On April 1st, GitLab announced Critical Security Release CVE-2022-1162, disclosing a very bizarre vulnerability and illustrating some important lessons in securing a software supply chain.

Learn how Legit Security discovered a vulnerable GitHub actions workflow. Get details on the vulnerability and and what you can do to mitigate it.

Best Practices Legit Threats SCMs

Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline

Learn how Legit Security discovered a vulnerable GitHub actions workflow. Get details on the vulnerability and and what you can do to mitigate it.

What are secrets in source code, why they must be protected, and how to keep them safe.

Explainers Threats SCMs

Detecting Secrets in Your Source Code

What are secrets in source code, why they must be protected, and how to keep them safe.

Blogs about SCMs

Topic

Sign up for our newsletter

Legitify adds support for GitLab and GitHub Enterprise Server

Novel Pipeline Vulnerability Discovered; Rust Found Vulnerable

Introducing Legitify: A Better Way To Secure GitHub

GitHub Codespaces Security Best Practices

Attackers Can Bypass GitHub Required Reviewers to Submit Malicious Code

Google & Apache Found Vulnerable to GitHub Environment Injection

Breaking News: How a Massive Malware Attack Almost Occurred on GitHub

Securing GitHub: How to Keep Your Code and Pipelines Safe from Hackers

GitHub Security Best Practices Your Team Should Be Following

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

Latest GitHub OAuth Tokens Attack Explained and How to Protect Yourself

A Cautionary Tale: The Untold Story of the GitLab CVE Backdoor (CVE-2022-1162)

Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline

Detecting Secrets in Your Source Code

Schedule a Demo