Author name: ITMAITY

tech blog

Vibe coding with GitHub Copilot: Agent mode and MCP support rolling out to all VS Code users

Allow us to reintroduce ourselves: GitHub Copilot is getting a whole lot more agentic with increased context of your tools and services, powered by the world’s leading models, starting today. 👏 We are excited to roll out agent mode in Visual Studio Code to all users, now complete with MCP support that unlocks access to any context or capabilities you want. What’s more, we are thrilled to release a new open source and local GitHub MCP server, giving you the ability to add GitHub functionality to any LLM tool that supports MCP. 🤖 In keeping with our commitment to offer multi-model choice, we’re making Anthropic Claude 3.5, 3.7 Sonnet, 3.7 Sonnet Thinking, Google Gemini 2.0 Flash, and OpenAI o3-mini generally available via premium requests, included in all paid Copilot tiers. These premium requests are in addition to unlimited requests for agent mode, context-driven chat, and code completions that all paid plans have when using our base model (👀 more below). With the new Pro+ tier, individual developers get the most out of the latest models with Copilot. The agent awakening doesn’t stop there. We are also announcing the general availability of the Copilot code review agent, which in just over a month in preview has been used by over 1 million developers on GitHub. Plus, the general availability of next edit suggestions so you can tab tab tab your way to coding glory. 🏆 Agent mode in VS Code Agent mode is progressively rolling out to VS Code users in stable, as we aim for full availability to all users in the coming weeks. You can also manually enable it now. Compared to chat or multi-file edits, which allow you to propose code changes across multiple files in your workspace, agent mode is fundamentally capable of taking action to translate your ideas into code. With simple prompts, agent mode takes Copilot beyond answering a question, instead completing all necessary subtasks across automatically identified or generated files to ensure your primary goal is achieved. Agent mode can suggest terminal commands or tool calls and ask you to execute them. It also analyzes run-time errors with self-healing capabilities. Since the launch to VS Code Insiders in February, developers have been using agent mode for a variety of tasks: from autofixing code gen errors, to building webapps, to yeeting commits – whatever that means. 🙂 https://x.com/xthree/status/1902748372022264142 Agent mode is powered by your choice of Claude 3.5 and 3.7 Sonnet, Google Gemini 2.0 Flash, and OpenAI GPT-4o. Currently, agent mode achieves a pass rate of 56.0% on SWE-bench Verified with Claude 3.7 Sonnet. We anticipate agent mode to grow more capable as chain of thought reasoning models continue to advance. To activate agent mode, upgrade to the latest VS Code and enable in settings. Model Context Protocol (MCP) is now available in public preview Developers spend their days conducting a wide array of tasks to get the job done, from research, to navigating telemetry, to infrastructure management, to coding and debugging. And they use many tools for this, the so-called engineering stack. MCP allows you to equip agent mode with the context and capabilities it needs to help you, like a USB port for intelligence. When you enter a chat prompt in agent mode within VS Code, the model can use different tools to handle tasks like understanding database schema or querying the web. This setup allows for more interactive and context-sensitive coding support. For example, with a prompt to “Update my GitHub profile to include the title of the PR that was assigned to me yesterday,” agent mode would take that request, combined with the list of all available MCP tools, and ask an LLM what to do next. Over time, the agent would continue calling tools iteratively, until the task is complete. Already, GitHub is home to a massive and growing MCP ecosystem that you can discover and use today. Here is a great repository that acts as a community inventory with some of the best MCP servers to use. The GitHub local MCP server equips agent mode with compelling capabilities such as searching across repositories and code, managing issues and creating PRs – turning agent mode into a powerful user of the GitHub platform. Get started by setting up local and remote MCP servers and using tools with agent mode in Visual Studio Code. To get started with the GitHub local MCP server, visit the repository, now supported natively in VS Code. Premium model requests Since GitHub Universe, we introduced a number of new models for chat, multi-file edits, and now agent mode. With the general availability of these models, we are introducing a new premium request type. Premium requests are in addition to the unlimited requests for agent mode, context-driven chat, and code completions in all paid plans for our base model (currently: OpenAI GPT-4o). Customers with Copilot Pro will receive 300 monthly premium requests, beginning on May 5, 2025. Customers with Copilot Business and Copilot Enterprise will receive 300 and 1000 monthly premium requests respectively, starting between May 12 and May 19, 2025. Until then, use of these premium models is unlimited. We are also introducing a new Pro+ plan for individuals with 1500 monthly premium requests and access to the best models, like GPT-4.5, for $39 per month. Copilot paid users1 will also have the ability to pay-as-you-go for additional premium request usage. Individuals and organizations can choose to opt-in to use additional requests beyond their included amount, in addition to setting spending limits on requests to control costs with ease. GitHub Copilot Business and Enterprise administrators can manage requests via their Copilot Admin Billing Settings. Additional premium requests start at $0.04 per request. Each premium model will consume a specific number of premium requests, allowing you to use a more powerful or efficient model when you need it, all while you have continued, unlimited access to Copilot’s base model. You can learn more about how seat-based premium requests will work in our documentation. Happy 50th birthday,

tech blog

Your AI Companion

As I look back on the incredible impact that Microsoft has had over its now 50 years of relentless innovation, I’m inspired by the simplicity and power of Bill Gates’ bold ambition all those years ago: to put a PC on every desk and in every home. At Microsoft AI we’re driven by that same spirit. Today, we’re creating Copilot, an AI companion for everyone. What does this mean? What does it look like? What does it do? Truth is, there’s no single answer that captures it. Because it’s going to look and feel a little different for each of us. An AI companion is completely personal, built around individual needs, values and expectations. That’s why ultimately, there will be as many different Copilots as there are people using them. Today, we are embarking on the journey to take Copilot from an AI companion to your AI companion. With your permission, Copilot will now remember what you talk about, so it learns your likes and dislikes and details about your life: the name of your dog, that tricky project at work, what keeps you motivated to stick to your new workout routine. Copilot will understand you in the context of your life, and show up, on your terms, in the right way at the right time. This is far richer, more dynamic, supportive and emergent than any software we’ve seen before. It’s a new kind of relationship with technology, a new era. Of course, we’re also focusing on the fundamentals: engaging personality, incredible search capability, custom-made answer cards, bespoke podcasts. With Deep Research you have a world-class researcher working alongside you. With Shopping, a trusted, impartial partner, looking out for the best products and deals. With Actions, let Copilot shoulder some of the burden, from scoring the gig tickets to sorting the ride home. Our new Windows app means your computer finally works on your behalf. And now with Copilot Vision on Mobile, Copilot can see what you see, responding in real time to create a shared understanding of your world. But the important point is that throughout Copilot is more than an AI, it’s yours. It remembers not just what you said, but who you are. Copilot helps you stay organized, think clearly, learn more intuitively. It’s there when you need a quick factual answer, a long exploratory debate or when you fancy just downloading after a hard day. Every day we hear the most incredible stories about the many and varied ways people enjoy Copilot. So, as we continue on our journey to create a Copilot for everyone, we’re focusing on one critical goal: to make it truly yours. Each will have its own unique style and blend of attributes that distinctly suit each and every one of us. All the while, we’ll stick to our core promise. You remain in control, you are the pilot and you make the calls and set the boundaries. We can’t wait for you to discover your personal Copilot. Mustafa Suleyman, Executive Vice President and CEO of Microsoft AI __________ Today, we announced a set of new updates that represent the next chapter in our vision to deliver a true AI companion — helping make AI more useful by making it more personal. Table of contents Memory Actions Copilot Vision Pages Podcasts Shopping Deep Research Copilot Search YouTube Video Click here to load media Memory and Personalization Memory is essential for creating a true AI companion. With Memory, Copilot can remember important details: your favorite food, the types of films you enjoy and your nephew’s birthday and his interests. As you interact with Copilot, it notes your preferences, building a richer user profile and offering tailored solutions, proactive suggestions and timely reminders. Copilot prioritizes security and privacy, giving you control through the user dashboard and the option to choose which types of information it remembers about you or to opt out entirely. You remain in control. YouTube Video Click here to load media As we explore the full range of what true personalization means, we are experimenting with new ways for you to interact with your Copilot. For example, what if your Copilot had an appearance and you could shape and form it to be whatever you want? We’re early in this thinking but soon you’ll have the ability to personalize Copilot and interact with your AI companion in a fun way while it offers advice and support when you want it. You can strike up a conversation with Copilot and now have an entertaining appearance that’s unique to you. YouTube Video Click here to load media Actions Another key advancement that makes Copilot a helpful AI companion is its ability to now take action on your behalf. With Actions, Copilot can now partner with you to complete tasks behind the scenes. Use simple chat prompts to ask Copilot to book event tickets, grab dinner reservations or send a thoughtful gift to a friend and it will check that task off your list. Copilot Actions will work with most websites across the web, and we’re particularly excited to highlight our launch partners: 1-800-Flowers.com, Booking.com, Expedia, Kayak, OpenTable, Priceline, Tripadvisor, Skyscanner, Viator and Vrbo. YouTube Video Click here to load media Copilot Vision We introduced Vision in Copilot for the web late last year and now we’re bringing it to mobile and Windows. Copilot and your phone’s camera now enable an interactive experience with the real world, in real time. From the Copilot app on your phone, you can look around at your surroundings and request information, guidance or ideas. It can analyze both real-time video from the camera and photos stored on your camera roll. For example, use Vision to improve plant health by asking it to examine your plants and suggest actions, or to scan your office and provide tips on decoration. Vision on Mobile is available today in the Copilot app for iOS and Android. The new native Windows app will allow you to call upon Copilot while working

tech blog

Celebrating Microsoft’s 50 years

Satya Nadella, Chairman and CEO, shared the following remarks at Microsoft’s 50th anniversary today. It’s so wonderful to be here with all of you celebrating 50 years of Microsoft. And it’s especially exciting to be doing it at a time like this. For me, though, it starts with Bill [Gates] and Steve [Ballmer], who are both here with us today. I want to say a very big thank you to the two of you, and to Paul [Allen], and what you’ve meant to me personally and your vision that you had building this extraordinary company of ours that I’ve had the privilege to be part of. Thank you for your vision, your leadership, your passion, and for building the Microsoft that we know today. A company that has truly changed the world. Fifty years ago, Bill and Paul started Microsoft with a simple but powerful idea: to build technology so people everywhere could build more technology. The very first product Microsoft built was the Basic interpreter for the Altair, giving people the power to create software, jumpstarting the PC revolution, and creating an entirely new sector for our economy. YouTube Video Click here to load media But today, it’s not just about the past 50 years, it’s about the next 50. If there’s one thing that I have learned during my time at Microsoft, it’s not about longevity, but relevance. Our future will not be defined by what we have built, but what we empower others to build. This is why we are leading this new wave of AI innovation and more importantly, democratizing it, just like we did with the PC. From there we’ve gone to chat, to multi file edits, and now to agents. More than 150 million developers in nearly every country around the world are using GitHub. So, I thought to myself, what if I could take that power and rebuild Microsoft’s very first product? And so, I tried it. YouTube Video Click here to load media You really know you’re on to something. Intelligence has been commoditized when CEOs can start vibe coding. But in all seriousness, this is not just a cool party trick, It’s transformational. It’s empowering. It’s unleashing human ambition. And it’s happening now. In fact, I’m excited to share that the capability I just showed with Agent Mode is rolling out to all Visual Studio Code users starting today. We now have autonomous AI agents or peer programmers who can collaborate with us to anticipate our needs and help us think more creatively, and it does not stop there. We are bringing full MCP support to Agent Mode; we’re also launching Code Review Agent today to fix and fine bugs automatically; we’re also making it easier than ever before for developers to build their own agents in Azure AI Foundry. Think of it like an agent factory. It’s a production line for intelligence. Tens and thousands of organizations are using Foundry to build their own agents. And today, we’re going further. We now have a new agent framework for building multi-agent systems. But building agents is just the very beginning. We’re also building tools for all the evals, fine tuning, observability, and feedback. And you’ll also have a red teaming agent and tools to measure code vulnerabilities. All of this in support of building trustworthy AI systems. There’s much, much more to come. What started out as a developer tools company 50 years ago is now a platform company where everyone can be a developer. Our mission has not changed, it’s only expanded. Just as we have done always, we are putting the power in people’s hands so that they can build software that moves their communities, their countries forward. The same ethos is driving Copilot, not just for developers, but for every aspect of working life. Helping people do things that allow them to do more things, whether it’s building apps, doing homework, shopping, planning, and so much more. Ultimately, it all comes down to our mission to empower every person and every organization on the planet to achieve more. I’ve always thought of Microsoft as a platform and partner-first company, and this has only been possible because of our customers, our partners and developers, and our 1.6 million employees, past and present, who have connected their passion with our purpose to get us where we are today. And it’s you who will continue to build this company to have impact around the world well into the future. So, from the bottom of my heart, a big thank you to everyone who has contributed to Microsoft in getting us to this moment. I can’t wait to see what is next with Copilot and everything that we have for you. Remarks have been edited for clarity. Photo: Bill Gates, Microsoft Co-founder and Gates Foundation Chair; Steve Ballmer, former Microsoft CEO and Ballmer Group Co-founder; and Satya Nadella, Chairman and CEO of Microsoft, on stage at the anniversary event. The post Celebrating Microsoft’s 50 years appeared first on The Official Microsoft Blog. ​Satya Nadella, Chairman and CEO, shared the following remarks at Microsoft’s 50th anniversary today. It’s so wonderful to be here with all of you celebrating 50 years of Microsoft. And it’s especially exciting to be doing it at a time like this. For me, though, it starts with Bill [Gates] and Steve [Ballmer], who are… The post Celebrating Microsoft’s 50 years appeared first on The Official Microsoft Blog.  Featured, Recent News, The Official Microsoft Blog, 50th anniversary, Azure AI Foundry, Copilot, GitHub, Visual Studio Code The Official Microsoft Blog

tech blog

Transforming Urban Landscapes Through Technology

Discover how the City of Durham, NC is using AI to revolutionize city planning, safety and sustainability for its residents.   ​  ​Discover how the City of Durham, NC is using AI to revolutionize city planning, safety and sustainability for its residents. AI Solutions Blog | Dell

tech blog

Localhost dangers: CORS and DNS rebinding

At GitHub Security Lab, one of the most common vulnerability types we find relates to the cross-origin resource sharing (CORS) mechanism. CORS allows a server to instruct a browser to permit loading resources from specified origins other than its own, such as a different domain or port. Many developers change their CORS rules because users want to connect to third party sites, such as payment or social media sites. However, developers often don’t fully understand the dangers of changing the same-origin policy, and they use unnecessarily broad rules or faulty logic to prevent users from filing further issues. In this blog post, we’ll examine some case studies of how a broad or faulty CORS policy led to dangerous vulnerabilities in open source software. We’ll also discuss DNS rebinding, an attack with similar effects to a CORS misconfiguration that’s not as well known among developers. What is CORS and how does it work? CORS is a way to allow websites to communicate with each other directly by bypassing the same-origin policy, a security measure that restricts websites from making requests to a different domain than the one that served the web page. Understanding the Access-Control-Allow-Origin and Access-Control-Allow-Credentials response headers is crucial for correct and secure CORS implementation. Access-Control-Allow-Origin is the list of origins that are allowed to make cross site requests and read the response from the webserver. If the Access-Control-Allow-Credentials header is set, the browser is also allowed to send credentials (cookies, http authentication) if the origin requests it. Some requests are considered simple requests and do not need a CORS header in order to be sent cross-site. This includes the GET, POST, and HEAD requests with content types restricted to application/x-www-form-urlencoded, multipart/form-data, and text/plain. When a third-party website needs access to account data from your website, adding a concise CORS policy is often one of the best ways to facilitate such communication. To implement CORS, developers can either manually set the Access-Control-Allow-Origin header, or they can utilize a CORS framework, such as RSCors, that will do it for them. If you choose to use a framework, make sure to read the documentation—don’t assume the framework is safe by default. For example, if you tell the CORS library you choose to reflect all origins, does it send back the response with a blanket pattern matching star (*) or a response with the actual domain name (e.g., stripe.com)? Alternatively, you can create a custom function or middleware that checks the origin to see whether or not to send the Access-Control-Allow-Origin header. The problem is, you can make some security mistakes when rolling your own code that well-known libraries usually mitigate. Common mistakes when implementing CORS For example, when comparing the origin header with the allowed list of domains, developers may use the string comparison function equivalents of startsWith, exactMatch, and endsWith functions for their language of choice. The safest function is exactMatch where the domain must match the allow list exactly. However, what if payment.stripe.com wants to make a request to our backend instead of stripe.com? To get around this, we’d have to add every subdomain to the allow list. This would inevitably cause users frustration when third-party websites change their APIs. Alternatively, we can use the endsWith function. If we want connections from Stripe, let’s just add stripe.com to the allowlist and use endsWith to validate and call it a day. Not so fast, since the domain attackerstripe.com is now also valid. We can tell the user to only add full urls to the allowlist, such as https://stripe.com, but then we have the same problem as exactMatch. We occasionally see developers using the startsWith function in order to validate domains. This also doesn’t work. If the allowlist includes https://stripe.com then we can just do https://stripe.com.attacker.com. For any origin with subdomains, we must use .stripe.com (notice the extra period) in order to ensure that we are looking at a subdomain. If we combine exactMatch for second level domains and endsWith for subdomains, we can make a secure validator for cross site requests. Lastly, there’s one edge case found in CORS: the null origin should never be added to allowed domains. The null origin can be hardcoded into the code or added by the user to the allowlist, and it’s used when requests come from a file or from a privacy-sensitive context, such as a redirect. However, it can also come from a sandboxed iframe, which an attacker can include in their website. For more practice attacking a website with null origin, check out this CORS vulnerability with trusted null origin exercise in the Portswigger Security Academy. How can attackers exploit a CORS misconfiguration? CORS issues allow an attacker to make actions on behalf of the user when a web application uses cookies (with SameSite None) or HTTP basic authentication, since the browser must send those requests with the required authentication. Fortunately for users, Chrome has defaulted cookies with no Samesite to SameSite Lax, which has made CORS misconfiguration useless in most scenarios. However, Firefox and Safari are still vulnerable to these issues using bypass techniques found by PTSecurity, whose research we highly recommend reading for knowing how someone can exploit CORS issues. What impact can a CORS misconfiguration have? CORS issues can give a user the power of an administrator of a web application, so the usefulness depends on the application. In many cases, administrators have the ability to execute scripts or binaries on the server’s host. These relaxed security restrictions allow attackers to get remote code execution (RCE) capabilities on the server host by convincing administrators to visit an attacker-owned website. CORS issues can also be chained with other vulnerabilities to increase their impact. Since an attacker now has the permissions of an administrator, they are able to access a broader range of services and activities, making it more likely they’ll find something vulnerable. Attackers often focus on vulnerabilities that affect the host system, such as arbitrary file write or RCE. Real-world examples A CORS misconfiguration allows for RCE

tech blog

Maximize Productivity and Security with Dell Thin Clients

In a recent study, TechTarget’s Enterprise Strategy Group (ESG) set out to validate the benefits of adopting Dell thin client …   ​  ​In a recent study, TechTarget’s Enterprise Strategy Group (ESG) set out to validate the benefits of adopting Dell thin client … Customer Blog | Dell

tech blog

Simplifying Peripheral Management for the AI PC Era

Dell Pro Docks simplify IT with secure and manageable docking solutions for the AI PC. Featuring four new docks & powerful management tools.   ​  ​Dell Pro Docks simplify IT with secure and manageable docking solutions for the AI PC. Featuring four new docks & powerful management tools. Client Peripherals Blog | Dell

tech blog

GitHub for Beginners: How to get LLMs to do what you want

Welcome back to season two of GitHub for Beginners, a series designed to help you navigate GitHub more confidently! So far, we’ve explored how to use GitHub Copilot and some of its essential features. Today, we will be learning all about large language models (LLMs) and the basics of prompt engineering. LLMs are powerful, and the way we interact with them via prompts matters. For example, have you ever tried asking an LLM a question, but it can’t really figure out what you’re trying to ask? Understanding the power of prompts (and the limitations that come with them) can help you become even more productive. In this post, we’ll explore: How LLMs work and how prompts are processed. How to engineer the most effective prompts. How to troubleshoot prompts when we don’t get the outcomes we want. For all demos in this series, we use GitHub Copilot in Visual Studio Code. Copilot is available in other IDEs, but the available functionality may vary depending on your environment. Learn more about supported IDEs > Let’s get started! What’s an LLM? Large language models are a type of AI that are trained on a large (hence the name) amount of text data to understand and generate human-like language. By predicting the next word in a sentence based on the context of the words that came before it, LLMs respond to humans in a way that is relevant and coherent. Sort of like an ultra-smart autocomplete! When it comes to using LLMs, there are three important things to understand: Context: This is the surrounding information that helps an LLM understand what you’re talking about. Just like when you have a conversation with a friend, the more context you offer, the more likely the conversation will make sense. Tokens: For LLMs, text is broken down into units of tokens. This could be a word, part of a word, or even just one single letter. AI models process tokens to generate responses, so the number of tokens you use with an LLM can impact its response. Too few tokens can lead to a lack of context, but too many could overwhelm the AI model or run into its built-in token limits. Limitations: LLMs are powerful, but not all-powerful. Instead of understanding language like humans, LLMs rely on patterns and probabilities from training data. Taking a deeper dive into training data is beyond the scope of this post, but as a general rule, the ideal data set is diverse and broad. Models are never perfect—sometimes they can hallucinate, provide incorrect answers, or give nonsensical responses. What is a prompt? A prompt is a natural language request that asks an LLM to perform a specific task or action. A prompt gives the model context via tokens, and works around the model’s potential limitations, so that the model can give you a response. For example, if you prompt an LLM with “Write a JavaScript function to calculate the factorial of a number,” it will use its training data to give you a function that accomplishes that task. Depending on how a specific model was trained, it might process your prompt differently, and present different code. Even the same model can produce different outputs. These models are nondeterministic, which means you can prompt it the same way three times and get three different results. This is why you may receive different outputs from various models out in the world, like OpenAI’s GPT, Anthropic’s Claude, and Google’s Gemini. Now that we know what a prompt is, how do we use prompts to get the outputs we want? What is prompt engineering? Imagine that a friend is helping you complete a task. It’s important to give them clear and concise instructions if there’s a specific way the task needs to be done. The same is true for LLMs: a well-crafted prompt can help the model understand and deliver exactly what you’re looking for. The act of crafting these prompts is prompt engineering. That’s why crafting the right prompt is so important: when this is done well, prompt engineering can drastically improve the quality and relevance of the outputs you get from an LLM. Here are a few key components of effective prompting: An effective prompt is clear and precise, because ambiguity can confuse the model. It’s also important to provide enough context, but not too much detail, since this can overwhelm the LLM. If you don’t get the answer you’re expecting, don’t forget to iterate and refine your prompts! Learn all about prompt engineering for Copilot Chat Discover simple strategies in our documentation to write better prompts and improve your Copilot results. How to engineer better Copilot Chat prompts > Let’s try it out! Example: How to refine prompts to be more effective Imagine you’re using GitHub Copilot and say: Write a function that will square numbers in a list in a new file with no prior code to offer Copilot context. At first, this seems like a straightforward and effective prompt. But there are a lot of factors that aren’t clear: What language should the function be written in? Do you want to include negative numbers? Will the input ever have non-numbers? Should it affect the given list or return a new list? How could we refine this prompt to be more effective? Let’s change it to: Write a Python function that takes a list of integers and returns a new list where each number is squared, excluding any negative numbers. This new prompt is clear and specific about what language we want to use, what the function should do, what constraints there are, and the expected input type. When we give GitHub Copilot more context, the output will be better aligned with what we want from it! Just like coding, prompt engineering is about effective communication. By crafting your prompts thoughtfully, you can more effectively use tools like GitHub Copilot to make your workflows smoother and more efficient. That being said, working with LLMs means there will still

tech blog

GitHub found 39M secret leaks in 2024. Here’s what we’re doing to help

If you know where to look, exposed secrets are easy to find. Secrets are supposed to prevent unauthorized access, but in the wrong hands, they can be—and typically are—exploited in seconds. To give you an idea of the scope of the problem, more than 39 million secrets were leaked across GitHub in 2024 alone.1 Every minute GitHub blocks several secrets with push protection.2 Still, secret leaks remain one of the most common—and preventable—causes of security incidents. As we develop code faster than ever previously imaginable, we’re leaking secrets faster than ever, too. That’s why, at GitHub, we’re working to prevent breaches caused by leaked tokens, credentials, and other secrets–making protection against secret exposures accurate, built-in, and accessible to every developer. Today, we’re launching the next evolution of GitHub Advanced Security, aligning with our ongoing mission to keep your secrets…secret. Secret Protection and Code Security, now available as standalone products Advanced Security for GitHub Team organizations A free, organization-wide secret scan to help teams identify and reduce exposure.3 Here’s how secrets leak, what we’re doing to stop it, and what you can do to protect your code. Let’s jump in. How do secret leaks happen? Most software today depends on secrets—credentials, API keys, tokens—that developers handle dozens of times a day. These secrets are often accidentally exposed, which makes sense. Less intuitively, a large number of breaches come from well-meaning developers who purposely expose a secret. Developers also often underestimate the risk of private exposures, committing, sharing, or storing these secrets in ways that feel convenient in the moment, but which introduce risk over time. Unfortunately, these seemingly innocuous secret exposures are small threads to pull for an attacker looking to unravel a whole system. Bad actors are extremely skilled at using a foothold provided by “low risk” secrets for lateral movement to higher-value assets. Even without the risk of insider threats, persisting any secret in git history (or elsewhere) makes us vulnerable to future mistakes. Research shows that accidental mistakes (like inadvertently making a repository public) were higher in 2024 than ever before. If you’re interested in learning more about secret leaks and how to protect yourself, check out this great video from my colleague Chris Reddington: What is GitHub doing about it? We care deeply about protecting the developer community from the risk of exposed secrets. A few years ago, we formally launched our industry partnership program, which has now grown to hundreds of token issuers like AWS, Google Cloud Platform, Meta, and OpenAI—all fully committed to protecting the developer community from leaked secrets. 💡 Did you know? GitHub partners with providers to build detectors for their secrets behind-the-scenes. This improves our ability to detect secrets accurately and quickly, and to work together to mitigate risk in the case of a publicly leaked secret. In the case of a public leak, GitHub not only notifies you with a secret scanning alert, but also immediately notifies the secret issuer (if they participate in the GitHub secret scanning partnership program). The issuer can then take action depending on their policy, like quarantining, revoking, or further notifying involved parties. Last year, we rolled out push protection by default for public repositories, which has since blocked millions of secrets for the open source community. And finally, as of today, we’re rolling out additional changes to our feature availability, aligning with our ongoing goal to help organizations of all sizes protect themselves from the risk of exposed secrets: a new point-in-time scan, free for organizations; a new pricing plan, to make our paid security tooling more affordable; and the release of Secret Protection and Code Security to GitHub Team plans. What you can do to protect yourself from exposed secrets The easiest way to protect yourself from leaked secrets is not to have any in the first place. Push protection, our built-in solution, is the simplest way to block secrets from accidental exposure. It leverages the same detectors that we created through our partnership program with cloud providers, ensuring secrets are caught quickly and accurately with the lowest rate of false positives possible. Get started Push protection prevents secret leaks–without compromising the developer experience–by scanning for secrets before they are pushed. You can enable push protection immediately with a couple clicks from your repository, organization, and enterprise settings. Studies have shown that GitHub Secret Protection is the only secret scanning tool—proprietary or open source—that can claim an over one in two true positive rate across all findings4. GitHub received a precision score of 75% (compared to the next best, 46% precision). Compared to alternatives like open source scanning solutions, it’s not that GitHub is finding fewer secrets, it’s that we’re finding real ones, so that you can spend your time worrying less about false positives, and more about what matters–shipping. 💡 Did you know? GitHub leverages GitHub Copilot in order to also detect unstructured secrets like passwords with extremely low false positive rates. My colleagues Ashwin Mohan and Courtney Claessens just wrote a great piece, which goes into depth on how we built Copilot secret scanning. Long-lived credentials are some of the most common and dangerous types of secrets to leak, as they often persist unnoticed for months–or years–and give bad actors extended access. That’s why managing secrets through their full lifecycle is critical. Beyond push protection, you can protect yourself from leaks by following security best practices to ensure secrets are securely managed from creation to revocation: Creation: follow the principle of least privilege and make sure secrets are securely generated. Rotation: outside of user credentials, secrets should be regularly rotated. Revocation: restrict access when no longer needed–or when compromised. Throughout the lifecycle of a secret, you should eliminate human interaction and automate secret management whenever possible. In addition, you should adopt a continuous monitoring solution for detecting exposures, so you can react quickly. Like push protection, GitHub’s built-in solution for secret scanning is the simplest way to triage previously leaked secrets. Starting today, investing in GitHub’s built-in security tooling is more

tech blog

How engineers can use one-on-ones with their manager to accelerate career growth

One-on-one meetings with your manager are one of the most valuable tools you have for career growth, problem-solving, and unlocking new opportunities. So if you’re only using them to provide status updates, you’re leaving a lot on the table. I didn’t fully realize this potential until I mentioned in a one-on-one that I was interested in mentorship and growing my leadership skills. Not long after, I was asked to co-lead a project with an intern to build an internal tool that helped surface enterprise configuration details. This gave me the opportunity to take technical ownership on a project while mentoring someone in a real-world context—both of which pushed me outside my comfort zone in the best way. That experience made it clear: When used intentionally, one-on-ones can open doors you didn’t even know were there. Many engineers treat one-on-ones as a low-stakes standup: reporting work, mentioning blockers, and getting general feedback. While that can be useful, it barely scratches the surface of what these meetings can accomplish. Instead, think of them as a system design review for your role—a time to debug challenges, optimize your workflow, and align on long-term career goals. Reframing your perception of what a one-on-one can accomplish A well-structured one-on-one meeting with your manager isn’t just a check-in, it’s an opportunity to shape your work environment and career trajectory. You wouldn’t build a system without evaluating its constraints, dependencies, and long-term maintainability. Why approach your career any differently? Start by shifting your mindset: These meetings are not status updates. Your manager already sees your pull requests, sprint velocity, and planning docs. Instead, use this time to highlight what matters—what you’ve shipped, the value it’s delivered, and where the friction is. You can also use this space to validate decisions and gather context. If you’re weighing different paths forward, don’t just ask for approval—frame the conversation in terms of trade-offs: “Here are the pros and cons of refactoring this service now versus later. How does this align with our broader business goals?” Treat your manager like a decision-making API: Feed in the relevant signals, surface what’s unclear, and work together on an informed response. Use one-on-ones for career versioning (even before you’re “ready”) One-on-one meetings are a great time to discuss your long-term career growth—even if you’re not actively seeking a promotion. Instead of waiting until promotion season, start having these conversations early to build clarity, direction, and momentum over time. If you’re more than a year away from seeking a promotion, start talking to your manager about: Where am I already meeting expectations? Where should I focus on strengthening my skills? If you’re approaching the next level or considering going up for promotion soon, try focusing the conversation on: What kind of work would demonstrate readiness for the next level? Are there specific opportunities I can take on to grow my scope or visibility? By treating growth as an iterative process rather than an all-or-nothing milestone, you can continuously improve and course-correct based on early feedback. A useful framework for structuring these discussions is the Three Circles of Impact: Individual Contributions – The direct value of your work. Collaboration – How you work with and support others across the team. Enabling Others – Mentorship, knowledge sharing, or improving systems and tooling for your peers. If you’re not sure how to show impact across all three, your one-on-one is a great place to explore it. The key is surfacing your goals early so your manager can help guide you toward the kinds of work that will stretch your skills and broaden your influence. The more you shape your contributions around these areas, the clearer your readiness for growth becomes—and the easier it is for your manager to advocate on your behalf. Your manager can’t debug what they don’t see Managers don’t have full visibility into your day-to-day experience, so one-on-ones are the right time to highlight persistent blockers and unclear expectations. For instance, I once brought up a latency issue I was chasing down. The endpoint’s performance was slightly above our service level objective (SLO) target, and I had already spent a good chunk of time optimizing it. But in that conversation, my manager offered a different lens: “Are we optimizing for the right thing? We control the SLO. If the extra latency is due to how the system is designed (and if users aren’t impacted) maybe the right move is to revisit the threshold instead of squeezing more performance out of it.” That single conversation saved me hours and helped me reframe the problem entirely. Sometimes, the fix isn’t in your code—it’s in how you’re measuring success. Make your one-on-ones work for you Your one-on-ones will become far more effective—and lead to real growth—when you treat them as time to think strategically, not just check in. Reframing these meetings around your goals, your environment, and your long-term development puts you in a much stronger position to advocate for yourself and your work. Start thinking about your career progression earlier than feels natural. Come prepared. Bring in what’s going well, what’s stuck, and where you want to grow. And remember: your manager can’t fix what they don’t know about, and they can’t support your goals if you never share them. If this shift feels unfamiliar, you’re not alone. The Engineer’s Survival Guide helped me reframe my thinking around one-on-ones. Here are a few ideas that stuck with me: Your manager isn’t a mind reader. You can’t expect guidance if you don’t come with a direction. Your growth is a shared effort, but it starts with you. The earlier you see one-on-ones as a tool for impact and growth, the more value you’ll get from them. The post How engineers can use one-on-ones with their manager to accelerate career growth appeared first on The GitHub Blog. ​ Career growth, Developer skills, Engineering, Engineering principles, career development, engineering The GitHub Blog

tech blog

5 GitHub Actions every maintainer needs to know

Maintaining and contributing to open source projects can be rewarding—but it comes with a lot of small, repetitive tasks. The good news? GitHub Actions can automate the more tedious and error-prone parts of maintainership, freeing you up to focus on what matters: building and growing your community. Whether you’ve just launched your project or you’re looking to scale, here are a few of the most helpful actions to help you along your way. Pro tip: It’s best practice to audit the source code of any action you use, and pin actions to a full length commit SHA so that you always know what version of the code you’re using. Now, let’s get started. 1. Clean up your backlog with stale Managing issues or pull requests can be challenging, especially when users open issues that require additional information to resolve. If they don’t respond with what you need, these issues can pile up and make your backlog look daunting. Stale closes any issues or pull requests that lack activity after a set number of days, keeping your open issues list nice and tidy. 👉 Who uses it: DeepSeek-R1, opentelemetry-go, and more. 2. Let super-linter sweat the small stuff for you It’s awesome when someone takes the time to submit a pull request to your project. It’s not so awesome when you have to manually reject that pull request because of a small mistake. A linter is a tool that helps you enforce best practices and consistent formatting. Super-linter is a collection of linters for a variety of languages that can automate many of the chores associated with code reviews, including enforcing style guidelines, detecting syntax errors, identifying security vulnerabilities, and ensuring code consistency across multiple languages. 👉 Who uses it: Barman, frankenphp, and more. 3. Stop repeating yourself with create-or-update-comment Repetitive comments for common scenarios can become tedious. Create-or-update-comment offers a reprieve, enabling you to automate tasks, like sending welcome messages to new contributors or providing standardized feedback when linters and other automated processes detect problems. 👉 Who uses it: woocommerce, lucide, and more. 4. Create release notes with ease with Release Drafter After all the merging, testing, and other work that goes into preparing a release, writing up the release notes is often the last thing you want to do. The good news: Release Drafter automates the process for you. Each time you merge a pull request, it updates a draft text of your release notes, so they’ll be ready when it’s time to publish. 👉 Who uses it: LightGBM, Mealie, and more. 5. Stay organized with pull request labeler Overwhelmed with PRs? Pull request labeler automatically labels pull requests based on the files or branch modified, helping you triage work and maintain a consistent labeling system. 👉 Who uses it: Apache Lucene, Marvin, and more. Maintaining an open source project is a labor of love, but with the right tools, it doesn’t have to feel overwhelming. These actions are just a few examples of how automation can save time, reduce frustration, and help you focus on writing great code and growing your community. Why not give them a try and see how they can transform your open source journey? Your future self (and your contributors) will thank you! Find more actions on GitHub Marketplace. The post 5 GitHub Actions every maintainer needs to know appeared first on The GitHub Blog. ​ Maintainers, Open Source, GitHub Actions The GitHub Blog

tech blog

A maintainer’s guide to vulnerability disclosure: GitHub tools to make it simple

Imagine this: You’re sipping your morning coffee and scrolling through your emails, when you spot it—a vulnerability report for your open source project. It’s your first one. Panic sets in. What does this mean? Where do you even start? Many maintainers face this moment without a clear roadmap, but the good news is that handling vulnerability reports doesn’t have to be stressful. Below, we’ll show you that with the right tools and a step-by-step approach, you can tackle security issues efficiently and confidently. Let’s dig in. What is vulnerability disclosure? If you discovered that the lock on your front door was faulty, would you attach a note announcing it to everyone passing by? Of course not! Instead, you’d quietly tell the people who need to know—your family or housemates—so you can fix it before it becomes a real safety risk. That’s exactly how vulnerability disclosure should be handled. Security issues aren’t just another bug. They can be a blueprint for attackers if exposed too soon. Instead of discussing them in the open, maintainers should work with security researchers behind the scenes to fix problems before they become public. This approach, known as Coordinated Vulnerability Disclosure (CVD), keeps your users safe while giving you time to resolve the issue properly. To support maintainers in this process, GitHub provides tools like Private Vulnerability Reporting (PVR), draft security advisories, and Dependabot alerts. These tools are free to use for open source projects, and are designed to make managing vulnerabilities straightforward and effective. Let’s walk through how to handle vulnerability reports, so that the next time one lands in your inbox, you’ll know exactly what to do! The vulnerability disclosure process, at a glance Here’s a quick overview of what you should do if you receive a vulnerability report: Enable Private Vulnerability Reporting (PVR) to handle submissions securely. Collaborate on a fix: Use draft advisories to plan and test resolutions privately. Request a Common Vulnerabilities and Exposures (CVE) identifier: Learn how to assign a CVE to your advisory for broader visibility. Publish the advisory: Notify your community about the issue and the fix. Notify and protect users: Utilize tools like Dependabot for automated updates. Now, let’s break down each step. 1. Start securely with PVR Here’s the thing: There are security researchers out there actively looking for vulnerabilities in open source projects and trying to help. But if they don’t know who to report the problem to, it’s hard to resolve it. They could post the issue publicly, but this could expose users to attacks before there’s a fix. They could send it to the wrong person and delay the response. Or they could give up and move on. The best way to ensure these researchers can reach you easily and safely is to turn on GitHub’s Private Vulnerability Reporting (PVR). Think of PVR as a private inbox for security issues. It provides a built-in, confidential way for security researchers to report vulnerabilities directly in your repository. 🔗 How to enable PVR for a repository or an organization. Heads up! By default, maintainers don’t receive notifications for new PVR reports, so be sure to update your notification settings so nothing slips through the cracks. Enhance PVR with a SECURITY.md file PVR solves the “where” and the “how” of reporting security issues. But what if you want to set clear expectations from the start? That’s where a SECURITY.md file comes in handy. PVR is your front door, and SECURITY.md is your welcome guide telling visitors what to do when they arrive. Without it, researchers might not know what’s in scope, what details you need, or whether their report will be reviewed. Maintainers are constantly bombarded with requests, making triage difficult—especially if reports are vague or missing key details. A well-crafted SECURITY.md helps cut through the noise by defining expectations early. It reassures researchers that their contributions are valued while giving them a clear framework to follow. A good SECURITY.md file includes: How to report vulnerabilities (ex: “Please submit reports through PVR.”) What information should be included in a report (e.g., steps to reproduce, affected versions, etc.) Pairing PVR with a clear SECURITY.md file helps you streamline incoming reports more effectively, making it easier for researchers to submit useful details and for you to act on them efficiently. 2. Collaborate on a fix: Draft security advisories Once you confirm the issue is a valid vulnerability, the next step is fixing it without tipping off the wrong people. But where do you discuss the details? You can’t just drop a fix in a public pull request and hope no one notices. If attackers spot the change before the fix is officially released, they can exploit it before users can update. What you’ll need is a private space where you and your collaborators can investigate the issue, work on and test a fix, and then coordinate its release. GitHub provides that space with draft security advisories. Think of them like a private fork, but specifically for security fixes. Why use draft security advisories? They keep your discussion private, so that you can work privately with your team or trusted contributors without alerting bad actors. They centralize everything, so your discussions, patches, and plans are kept in a secure workspace. They’re ready for publishing when you are: You can convert your draft advisory into a public advisory whenever you’re ready. 🔗 How to create a draft advisory. By using draft security advisories, you take control of the disclosure timeline, ensuring security issues are fixed before they become public knowledge. 3. Request a CVE with GitHub Some vulnerabilities are minor contained issues that can be patched quietly. Others have a broader impact and need to be tracked across the industry. When a vulnerability needs broader visibility, a Common Vulnerabilities and Exposures (CVE) identifier provides a standardized way to document and reference it. GitHub allows maintainers to request a CVE directly from their draft security advisory, making the process seamless. What is a CVE, and why does it matter? A

tech blog

Mastering GitHub Copilot: When to use AI agent mode

Ever find yourself staring at an AI coding assistant, wondering why it’s not quite nailing what you need? Maybe it’s spitting out code that’s close but not quite right, or you’re stuck wrestling with a problem that spans multiple files, wishing it could just get the bigger picture. Often, when developers hit these snags, it’s less about the tool, and more about knowing how to use it. So here’s the key question you should ask yourself: “Do I need a quick answer or a thoughtful conversation?” That’s the secret to unlocking AI coding tools like GitHub Copilot. Because different aspects of Copilot serve different needs, and we’re here to help you discern when is the best time for agent mode and when you should be using Copilot Edits instead. Both are powerhouse Copilot features, built to supercharge your coding, but they shine in different scenarios. Copilot Edits is your go-to for fast, precise tweaks—think refactoring a function, squashing a bug, or applying consistent changes across files without losing your flow. Agent mode, on the other hand, steps up as your AI collaborator for thornier, multi-file challenges—analyzing your codebase, proposing architectural fixes, and even running terminal commands while you steer the ship and approve each move. Figuring out which one fits your needs doesn’t just save time, it turns your AI assistant into a seamless extension of your own coding instincts. Copilot command center: Your chat window Before learning more about agent mode and Copilot Edits, it’s essential to understand the Copilot chat window in VS Code—your central hub for AI interactions. This is where you can: Ask coding questions like “How do I implement JWT authentication in Node.js?” Use /explain to understand complex code blocks Debug issues with /fix Generate tests with /tests Access both Edits and agent mode features With the chat window giving you a solid grasp of your code’s context, you’re in the driver’s seat to pick the perfect Copilot tool: Edits or agent mode, for whatever’s next. Let me take you through a real-world example of how I’ve been using GitHub Copilot to evolve my personal website. It started with a simple idea: create an interactive terminal-style easter egg that showcases my skills in a developer-friendly way. I began with a basic command processing function that handled a few simple commands: function processCommand(command) { try { if (!command?.trim()) { return ‘Please enter a command. Type “more” for available commands.’; } const sanitizedCommand = command.toLowerCase().trim(); switch (sanitizedCommand) { case ‘more’: return commands.more; case ‘about’: return commands.about; case ‘skills’: return commands.skills; case ‘projects’: return commands.projects; case ‘contact’: return commands.contact; default: return `Command not found: “${command}”. Type ‘more’ for available commands.`; } } catch (error) { console.error(‘[Terminal] Error processing command:’, error); return ‘An error occurred while processing the command.’; } } Initially, I used Copilot Edits to quickly add new features. For instance, I wanted to add a ‘github’ command to showcase my repositories: Copilot Edits made targeted changes to the switch statement in the processCommand function and added the new command to the commands object—a perfect example of quick, focused modifications to existing code. As my terminal interface matured, I wanted to implement several interactive features that would require more comprehensive improvements. To get animation effects, keyboard navigation controls, and an extensible theming system that spanned multiple files to work together seamlessly, I turned to agent mode. The agent mode advantage When we designed agent mode, we didn’t want to create a tool that’s a simple AI feature: We wanted to create an AI that could pair with you! Rather than working on specific, limited changes where you might be reinventing the wheel, you’re now providing higher-level direction while the AI tackles the implementation details across multiple files or systems. That being said, with agent mode, you’re still in control of the process. The AI has more latitude to explore your codebase and suggest comprehensive solutions, but you always review and approve the changes before they’re applied. It’s not about surrendering control, it’s about effectively delegating implementation details while you focus on the bigger picture. What makes agent mode special: Codebase search: It searches your codebase to find relevant files without you explicitly specifying them. Self-iteration: It can iterate on its own output to complete your entire request in one go. Error identification and repair: It automatically recognizes and fixes errors in suggested code. Terminal command execution: It suggests and runs terminal commands with your permission. Build and run capabilities: It can build and run your application to check if changes work correctly. I reach for agent mode when: Building complete features: “Add analytics tracking throughout the app” Navigating unfamiliar codebases: “Help me understand how authentication works in this project” Writing and verifying tests: “Write tests for the UserService and make sure they pass” Implementing terminal-heavy tasks: “Set up a new React project with TypeScript, Redux, and styled-components” Doing complex refactoring: “Refactor our API calls to use the new error handling pattern” Continuing with my terminal easter egg, let’s say I want to implement a much more extensive upgrade with multiple features, like adding a typing animation effect for responses, command history navigation with up/down arrows, and tab completion for commands. At the same time, I want to create a new TerminalThemes.css file with different color scheme options that users can switch between with a ‘theme’ command. This is where agent mode truly shines. The task spans multiple files, requires an understanding of the existing codebase, and involves creating entirely new functionality. Here, agent mode would: Search through the codebase to understand the terminal implementation. Create the new CSS file for themes. Add typing animation functionality to terminal responses. Implement keyboard handlers for history navigation. Build the tab completion system. Add the theme command to the switch statement. Test the implementation to ensure everything works correctly. This is the beauty of agent mode: it has a complex understanding of patterns and relationships in different parts of the codebase! Agent mode can ensure that the typing animation did

tech blog

Transforming Character Animation with NVIDIA Omniverse and AI Workstations

From their studio in Finland, Cineshare is developing new approaches to character animation and virtual production that balance visual quality with performance constraints.   ​  ​From their studio in Finland, Cineshare is developing new approaches to character animation and virtual production that balance visual quality with performance constraints. Precision Blog | Dell

tech blog

Exploring the Future of Media and Entertainment Insights

Discover how AMD empowers creators with AI, real-time rendering and virtual production tools, redefining the future of storytelling.   ​  ​Discover how AMD empowers creators with AI, real-time rendering and virtual production tools, redefining the future of storytelling. Media & Entertainment Blog | Dell

Scroll to Top