#SLSA

11 related articles

Jul 28, 2026·3 min

GitHub Supply Chain Security Upgrade: A Deep Dive into npm and Actions Defense Mechanisms

GitHub upgrades supply chain defenses for npm and Actions with provenance attestation, least privilege enforcement, and anomaly detection to combat attacks.

Jul 28, 2026·3 min

GitHub Supply Chain Security Upgrade: A Deep Dive into npm and Actions Defense Mechanisms

GitHub upgrades supply chain defenses for npm and Actions with provenance attestation, least privilege principles, and anomaly detection across multiple layers.

Jul 27, 2026·3 min

How GitHub Established Reliable Ownership for 14,000 Repositories in 45 Days

GitHub had over 14,000 internal repos with less than half having clear ownership. In 45 days, they verified ownership for every active repo through activity filtering, validation, and archiving.

Jul 12, 2026·5 min

Zero-Dependency AI Decision Record Auditor: A Practical Guide to Building Traceable AI Systems

An in-depth analysis of the zero-dependency decision record auditor: from AI compliance and incident postmortems to human-AI accountability, exploring how 'Governance as Code' enables traceable, transparent AI decision-making.

Jul 11, 2026·7 min

Decoding the Government Software Security Executive Order: New Supply Chain Compliance and SBOM Requirements

The new U.S. Executive Order requires government software suppliers to provide verifiable security assurances and mandates the SBOM system. This article analyzes the policy's core demands, real impact on suppliers, and the chain of challenges.

Jul 10, 2026·4 min

AI Coding Tool Security Governance: How Policy Enforcement Guardrails Ensure Enterprise Compliance

As Claude Code, Cursor, and Codex enter enterprises at scale, policy enforcement guardrails are becoming critical. A deep dive into AI coding tool security governance, cross-platform compliance, and enforcement mechanisms.

Jul 9, 2026·4 min

AI Coding Security: A CLI Tool Designed to Block Vulnerable Dependencies for Agents

AI coding assistants (Copilot/Cursor/Claude Code) frequently introduce vulnerable dependencies and hallucinate package names. This post analyzes an Agent-native CLI security tool and the shift-left security philosophy for AI-era supply chains.

Jul 9, 2026·6 min

Unsloth Major Update: DeepSeek-V4 Support and a Deep Dive into NVFP4 Quantized Export

Unsloth v0.1.481-beta adds full DeepSeek-V4-Flash support, NVFP4/FP8/imatrix GGUF quantized export, 1.3x faster GRPO, 3-5x faster MoE training, and an OpenAI-compatible API service in Studio.

Jul 9, 2026·5 min

Git Hash Chain Malleability: How Fragile Is the Immutability You Trust?

Are Git hash chains truly immutable? This article dives into Git hash chain malleability, SHA-1 collision risks, and security boundaries, offering practical tips like GPG signing and SHA-256 migration to build a correct Git security trust model.

Jul 3, 2026·6 min

The New Normal of AI Programming: How Autonomous Agent Development Is Reshaping Software Engineering

AI Agent autonomous programming is evolving from niche experiments to the industry default. This article analyzes the three stages of AI-assisted programming, its impact on developer skills, process restructuring, and key challenges.

6 Free GitHub Security Settings Every …

Jul 3, 2026·4 min

6 Free GitHub Security Settings Every Maintainer Should Enable

GitHub offers 6 free security settings for open source maintainers: 2FA, Dependabot alerts, secret scanning, branch protection, permission reviews, and code scanning. Configure once, benefit long-term.