Post

Why does GitHub Security Lab do research like Man Yue Mo’s recent work on bypassing MTE on the Pixel 8? This question was asked on Hacker News and we think it’s worth a short thread. news.ycombinator.com/item?id=3975...

First an important point: we only research open source code, which means that many parts of your phone (for example most of your apps) are out-of-scope for us. That said, all open source code is in-scope, including projects that aren’t hosted on GitHub.

Open source software is the foundation of much of the world’s software. So when open source wins, we win. And that’s why @github.com takes its responsibility seriously, to help make open source software more secure.

GitHub Security Lab sits within GitHub Security, and we focus exclusively on open source security with four main priorities:

First, we run the GitHub Advisory Database, which is a comprehensive database of open source vulnerabilities. github.com/advisories