Dependabot version updates introduce default package cooldown Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration. New releases are a common entry point for supply chain attacks where a compromised or broken version can reach your dependency u
Use of the SSM Parameter Store's path-based API is now required. Support added in v2.0 to avoid it has been removed. The CHAMBER_NO_PATHS environment variable no longer has any effect. You must migrate to the new storage format using the instructions below, using a 2.x version of chamber. The --min-throttle-delay option no longer has any effect. Support for specifying a minimum throttle delay has
Menu. Currently selected: Install-time security defaults are now on npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation of the most sensitive uses of 2FA-bypass granular access tokens (GATs). Install-time security defaults are now on As of npm v12, the following npm ins
2026年6月23日に、GMO Flatt Security主催の「OSS開発者は今何をするべきか？ソフトウェアサプライチェーン侵害対策を考える」で「Hardening npm Publishing」というタイトルで、npmパッケージの公開フローをどう守るかについて話しました。 スライド: Hardening npm Publishing ローカルのトークン管理やnpm Trusted Publishingについては、以前の記事で書きました。 1Passwordを使って、ローカルにファイル(~/.configや.env)として置かれてる生のパスワードなどを削除した | Web Scratch パスワード管理/MFA管理の戦略 | Web Scratch npm Trusted PublishingでOIDCを使ってトークンレスでCIからnpmパッケージを公開する この記事ではそれらを前提に
Safer pull_request_target defaults for GitHub Actions checkout The pull_request_target event is one of the most commonly misused triggers in GitHub Actions, leading to vulnerabilities in workflows. Workflows triggered by pull_request_target run with the base repository’s GITHUB_TOKEN, secrets, and default-branch cache access. Checking out the head of an unreviewed pull request from a fork inside o
Menu. Currently selected: One policy, every repository Workflow execution protections are now in public preview for GitHub Enterprise, organizations, and repositories. This new capability lets enterprise administrators define an allow list that controls who can trigger GitHub Actions workflows and which events are permitted to run them, giving you predictable, secure workflow execution. Previously
When a compromised dependency in a CI/CD job steals your cloud credentials and leaks them, would you catch it? Would you have the logs to investigate afterward? cicd-sensor is an open-source sensor that lets every team answer both. Detection: Detects supply-chain attacks at runtime using process ancestry (e.g. credential access from a process descended from npm install) and correlation across sign
pnpm used to expand ${ENV_VAR} placeholders everywhere it found them — including in the .npmrc and pnpm-workspace.yaml files that live inside the repository you just cloned. That turned out to be a way for a malicious repository to steal the secrets in your environment. As of v10.34.2 and v11.5.3, pnpm stops expanding environment variables in repository-controlled registry and credential settings.
Our next npm major version, v12, introduces security-related default changes to npm install. All these changes are available behind warnings in npm today on 11.16.0 or newer, so you can prepare before the upgrade. v12 is estimated to release in July 2026. Each change turns an npm install behavior that runs automatically today into one you explicitly opt into: allowScripts defaults to off: npm inst
Calciforge Keep your castle secure and moving. A self-hosted safety layer for AI agents. Give each agent a clear contract: which models it may use, which commands it may run, where secrets may go, and what gets logged. The agent can ask for a secret by name; it does not need the raw key in memory. What Calciforge Does Calciforge sits between your AI agents and the places they can send messages, fe
2026年4月3日以降にお知らせしております「GitHubアカウントへの不正アクセス発生に関するお知らせとお詫び」に関連し、外部専門機関による調査結果を踏まえ、事案の詳細についてご報告いたします。 はじめにこのたびは、弊社のシステム環境にかかる不正アクセスの発生によりお客様の個人情報が漏えいするリスクを生じさせてしまいましたこと、深くお詫び申し上げます。 お客様からお預かりした個人情報を守ることは、私たちの最も基本的かつ重要な責務であるところ、今回、お客様に重大なご心配をおかけする事態となりましたことを、重く受け止めております。信頼回復に向け、今回の対処及び外部専門機関と連携した原因の徹底究明を完了し、加えてセキュリティ体制の抜本的な見直しと強化に着手しました。詳細について、以下にご報告いたします。引き続き本件を重要な経営課題として、安心してご利用いただけるサービスの実現に全力を尽くしてま
Per-process network monitoring for your terminal: live TCP, UDP, and QUIC connections with deep packet inspection, sandboxed by default. English | 简体中文 Real-time visibility into every connection your machine makes, who owns it, and what protocol it's speaking. No tcpdump, X11 forwarding, or root piping. Per-process attribution: Every TCP, UDP, and QUIC connection mapped to its owning process, via
「自分の作業を加速させる Claude」と「全社の生産性向上ツールとしての Claude」は、似て非なるものでした。 NOT A HOTEL コーポレートITチームでは、2026年2月から Claude Code を含む Anthropic 製品の組織導入に取り組んできました。個人で触っていた頃には見えなかった4つのリスク——シャドーIT 化、機密データの流出、コスト爆発、組織に定着せず活用が進まない——が、配布範囲を広げるほどに浮かび上がってきます。 この記事では、私たちが1ヶ月で組み上げた「4つのレイヤー」を、実装の具体例と実体験のエピソードを交えて紹介します。 アクセス制御 — Okta で SSO を実施し、公式テナントを作成してシャドーテナントの抑止 ガードレール — Managed Settings と 1Password CLI（op）で、危険な振る舞い・平文シークレットを構
May 26, 2026: GitHub recently detected a cyber-attack and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. It’s important to note that this investigation is still ongoing, and we will continue to provide details as appropriate. Given the reality of threat actors and the advent of AI technologies, w
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
