Accessing private GitHub repositories via MCP(invariantlabs.ai)

98 points by gokhan 1 year ago | 25 comments

GitHub Private Repos Considered Private-­Ish(tylercipriani.com)

115 points by fagnerbrack 3 years ago | 104 comments

GitHub Copilot CLI downloads and executes malware(promptarmor.com)

43 points by sarelta 8 months ago | 12 comments

Ghrc.io appears to be malicious(bmitch.net)

352 points by todsacerdoti 1 year ago | 58 comments

Blog post by Brandon Mitchell reporting that ghrc.io, a typo of GitHub's ghcr.io container registry, appears to steal GitHub credentials.

Mullvad exit IPs are surprisingly identifying(tmctmt.com)

521 points by RGBCube 5 months ago | 318 comments

Blog post explaining how Mullvad VPN deterministically assigns exit IPs based on a user's WireGuard key, making them usable as a fingerprinting vector.

Public secrets exposure leads to supply chain attack on GitHub CodeQL(praetorian.com)

285 points by cyberbender 1 year ago | 53 comments

GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos(noma.security)

487 points by ColinEberhardt 3 months ago | 187 comments

Noma Labs vulnerability research post describing how a crafted GitHub issue could trick GitHub's AI agent into leaking private repository contents.

GitHub is investigating unauthorized access to their internal repositories(twitter.com)

527 points by splenditer 5 months ago | 289 comments

A post on X from GitHub stating it is investigating unauthorized access to its internal repositories, with no current evidence of impact to customer data.

The GitHub wiki is an anti-pattern (2022)(michaelheap.com)

151 points by ibobev 1 month ago | 88 comments

A 2022 blog post by Michael Heap arguing that using the GitHub wiki for project documentation is an anti-pattern compared to a docs folder in the repo.

GitHub has not removed malicious imitation software after 3 weeks(successfulsoftware.net)

215 points by hermitcrab 1 month ago | 89 comments

A Successful Software blog post complaining that GitHub has not removed malicious software imitating the author's product three weeks after it was reported.

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown(wiz.io)

424 points by bo0tzz 6 months ago | 89 comments

Wiz Research blog post detailing CVE-2026-3854, a critical flaw in GitHub's internal git infrastructure enabling remote code execution on GitHub.com and GitHub Enterprise Server.

PeerTube is a free, decentralized and federated video platform(github.com)

592 points by doener 3 months ago | 274 comments

GitHub repository for PeerTube, an AGPL-licensed ActivityPub-federated video streaming platform that uses P2P delivery in the browser.