GitHub Copilot App Access Policy: An Enterprise Security Review Checklist
Review GitHub Copilot app access policies, managed settings, client separation, repository scope, and rollback evidence before enterprise rollout.
GitHub Actions Workflow Approval Holds: A Security Review Checklist
GitHub now holds certain potentially malicious GitHub Actions runs for approval in public repositories. Use this bounded review checklist before approving a held workflow.
CodeQL 2.26.1: A Security Review Checklist for New Analysis Coverage
Review CodeQL 2.26.1 coverage changes, compare SARIF outputs, and retest affected security paths without overclaiming static-analysis results.
GitHub Actions Workflow Approval: A Security Review Checklist
Review GitHub Actions workflow approval holds, trigger scope, permissions, and evidence before allowing a potentially malicious run to execute.
GitHub-Hosted Runner Groups: A Security Review Checklist for Policy-Controlled CI
GitHub is adding more policy control around GitHub-hosted runners, including runner groups that can direct jobs to runners meeting an organization’s requirements and the ability to disable standard hosted runners. That is useful for platform teams, but a policy setting is not the same thing as a verified security boundary. The practical question is: what
How to Verify a Local Vulnerability Database Before Trusting Scan Results
Verify the scanner artifact, signed vulnerability database, input hash, and partial-coverage limits before trusting a local vulnerability scan.
How to Scan a Local SBOM with CodeRiskTools Scanner
Scan a local SBOM with CodeRiskTools Scanner 3.1.1, verify the signed database profile, and interpret partial coverage without overclaiming.
GitHub Issues Agent Automation Controls: A Review Checklist
Review GitHub Issues agent automation controls for rationale, confidence, approvals, permissions, and evidence before enabling public-preview workflows.
GitHub Actions Workflow Trigger Allowlists: Review Checklist for Safer Execution
A source-backed checklist for reviewing GitHub Actions workflow trigger allowlists, event scope, permissions, reusable workflows, and deny/allow evidence.
GitHub Actions Read-Only Cache for Untrusted Triggers: A Review Checklist
Review GitHub Actions read-only cache behavior for untrusted triggers and validate cache keys, restored paths, permissions, and execution boundaries.