githubAug 4, 2026

How the GitHub legal team used Copilot CLI to streamline their workflows (opens in new tab)

GitHub’s legal team used Copilot CLI to turn repetitive legal work into customizable internal tools without relying on traditional software engineering. By expressing workflows, standards, and policies in plain language and Markdown, lawyers built systems that improved consistency, reduced drafting time, and preserved human oversight. The post argues that domain expertise can be operationalized into useful AI tools by anyone who can clearly define a process. ## Building a Contract Drafting Style Guide - Principal Product Counsel Ngandu Kasuku created **terms-ai** to manage varied commercial agreements involving data, infrastructure, and product integrations. - The tool stores instructions, drafting resources, workflows, and reference documents in a version-controlled repository. - An internal style guide enforces plain-language drafting and replaces repetitive prompt copying with consistent guidance. - A library of approved agreements lets the tool draw on prior work for addenda and new contracts. - Sensitive agreements remain in a controlled internal environment rather than the open-source repository. - Kasuku reports cutting drafting and review time roughly in half while producing more consistent provisions. - The main insight was that AI could support a lawyer’s own judgment and working style, not merely perform isolated tasks. ## Turning Legal Workflows into Plain-Language Instructions - Online Safety Counsel Jesse Geraci began with a workflow for analyzing source code in **DMCA** notices. - Copilot instructions covered triage, code comparison, license checks, circumvention review, policy references, and report templates. - Instead of traditional programming, the workflow encoded legal reasoning through structured instruction files. - Different modes were created for clients and lawyers, including faster client analysis, escalation recommendations, deeper legal review, and arguments for both sides. - The system later grew into a desktop application supporting contract review, NDA triage, risk assessment, compliance checks, and response drafting. - Reusable skills and agents handle tasks such as intake, playbook alignment, risk scoring, evidence verification, escalation, and report assembly. - Legal teams can still customize the system through readable Markdown, while human review remains essential. ## Broader Lessons for Nontechnical Teams - Repetitive work in almost any profession can be a starting point for automation. - Clear definitions of methodology, standards, and desired outputs can substitute for extensive programming knowledge. - Teams should begin with one bottleneck, use Copilot CLI to prototype a solution, and expand based on real usage. - These tools are decision-support systems—not replacements for professional judgment. Teams can use Copilot CLI to turn their existing expertise into repeatable, transparent workflows while retaining control over sensitive data and final decisions.

open-sourceaidesktop-appmarkdown+3

githubJul 15, 2026

GitHub for Beginners: Your roadmap to mastering the GitHub essentials (opens in new tab)

GitHub for Beginners presents a step-by-step roadmap from understanding version control to collaborating on projects through GitHub. It explains the essential Git concepts, account setup, repository creation, Markdown, and the GitHub flow. The central message is that beginners can master GitHub by learning a small set of practical tools and following a repeatable workflow. ## Understanding Version Control and Git - Version control tracks file changes over time, allowing developers to see what changed, when, and why. - Git replaces confusing file copies such as `final_v2` or `FINAL_actually` with a complete change history. - Git uses three main areas: - **Working directory:** where files are edited - **Staging area:** where changes are prepared for saving - **Local repository:** where committed history is stored - Core commands include: - `git status` to inspect changes - `git add` to stage changes - `git commit` to save a snapshot - “Pushing” code means uploading local commits to GitHub. ## Securing and Personalizing a GitHub Account - A GitHub account acts as a developer identity and should be protected with two-factor authentication. - 2FA can be enabled under **Settings → Password and authentication**. - Recovery codes should be downloaded and stored securely, such as in a password manager. - A profile README can serve as a public portfolio describing skills, projects, and interests. - The README appears on the profile when stored in a public repository named after the user’s GitHub username. ## Essential Git Commands - Beginners do not need to memorize all of Git; a small group of commands supports most daily workflows. - Important commands include: - `git config --global user.name "..."` to identify commits - `git init` to create a repository - `git clone <url>` to copy a remote repository locally - `git add .` to stage changes - `git commit -m "message"` to save changes - `git switch -c <branch>` to create and enter a branch - `git push` to upload commits - `git pull` to retrieve and merge remote changes - `git merge <branch>` to integrate another branch ## Creating a First Repository - A repository is a project’s home base: it stores files, tracks history, and supports collaboration. - To create one: - Select **New** from the GitHub dashboard - Choose a name - Set it as public or private - Optionally initialize it with a README - A `.gitignore` file excludes generated files, dependencies, system files, and temporary build output from version control. - A license communicates how others may use or share the project. ## Writing with Markdown - Markdown is a lightweight text-formatting language used throughout GitHub. - It powers READMEs, issues, pull requests, and comments. - Simple symbols and optional HTML tags can create readable documentation without complex tools. ## Following the GitHub Flow - GitHub flow provides a repeatable process for contributing safely: 1. Clone the repository 2. Create a branch 3. Make changes 4. Commit the work 5. Push the branch to GitHub 6. Open a pull request - Pull requests let colleagues review changes before they are merged. - The workflow applies to many shared projects, including repositories containing reusable AI prompts or other collaborative resources. Start with the basic Git commands, protect and document your GitHub profile, then practice the branch-and-pull-request workflow on a small repository. These fundamentals provide a practical foundation for contributing to larger team projects and open source.

open-sourcegithubgitmarkdown+3

githubJul 1, 2026

6 security settings every GitHub maintainer should enable this week (opens in new tab)

Joseph is a cybersecurity and AI expert who creates software and educational content to help developers build more securely. His open-source game, videos, and international speaking engagements have reached a broad audience, combining practical security guidance with accessible explanations. ## Cybersecurity and AI Leadership - Develops software and content focused on secure development. - Helps shape how developers approach cybersecurity and AI. ## Open-Source Security Education - Created the open-source game [gh.io/scg]. - More than 10,000 developers have used it to build future-proof security skills. ## Educational Videos - His videos have received over 2.8 million views. - Simplifies complex security topics into actionable advice for a global audience. ## International Speaking - Delivered 79 talks across 25 countries in the past four years. - Known for combining technical insight with energetic stage presence. Overall, Joseph’s work spans hands-on tools, accessible education, and public speaking, making cybersecurity knowledge more practical and widely available to developers.

open-sourceaicybersecuritysecure-software-development

githubJun 23, 2026

I automated my job (and it made me a better leader) (opens in new tab)

Ashley Willis is GitHub’s Senior Director of Developer Relations, where she focuses on open source, community, and developer advocacy. Her work combines leadership, accessibility, and inclusion, with an emphasis on making technology more human and building resilient teams. ### Leadership and Advocacy - Leads developer relations at GitHub. - Advocates for developers and open-source contributors. - Amplifies underrepresented voices in technology. ### Community and Accessibility - Builds supportive, inclusive spaces for contributors. - Focuses on creating tools that genuinely serve their users. - Works at the intersection of leadership, advocacy, and accessibility. Overall, Willis’s career centers on strengthening developer communities and making technology more inclusive, accessible, and human.

open-sourceaccessibilitygithubdeveloper-relations

githubMay 20, 2026

Investigating unauthorized access to GitHub-owned repositories (opens in new tab)

Alexis Wales is GitHub’s Chief Information Security Officer, responsible for protecting the platform, its products, and the open source community. With two decades of experience defending critical networks, she combines public- and private-sector expertise to address major cybersecurity challenges affecting modern technology. ## Leadership at GitHub - Leads a team of security professionals at GitHub. - Focuses on safeguarding GitHub’s platform and products. - Supports more than 150 million developers building and deploying software securely. - Helps protect the broader open source community. ## National Cybersecurity Experience - Has 20 years of experience defending critical national and private-sector networks. - Previously worked with the Department of Defense. - Served at the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA). ## Public-Private Collaboration - Her government experience shaped a strong interest in cooperation between public and private organizations. - Advocates collaboration to solve complex security threats affecting widely used technology. Overall, Wales’s work combines large-scale platform security with cross-sector cooperation to strengthen cybersecurity for developers and the broader technology ecosystem.

open-sourcecloud-securitygithubcybersecurity+1

githubApr 28, 2026

Securing the git push pipeline: Responding to a critical remote code execution vulnerability (opens in new tab)

Alexis Wales is GitHub’s Chief Information Security Officer, responsible for protecting the platform, its products, and the open source community. She leads security experts supporting more than 150 million developers and draws on two decades of experience defending critical networks. Her work has reinforced the importance of public-private collaboration in addressing major technology security threats. ## Leadership at GitHub - Oversees GitHub’s security strategy and teams. - Focuses on safeguarding developers, products, the platform, and the broader open source ecosystem. - Supports secure software development and deployment for more than 150 million developers. ## Cybersecurity Experience - Has 20 years of experience protecting national and private-sector networks. - Previously held roles with the Department of Defense and CISA. - Developed a strong interest in cooperation between government and industry. ## Focus on Collaboration - Advocates public-private partnerships to address complex cybersecurity challenges. - Applies her experience to threats affecting the technology people rely on every day.

open-sourcegithubcybersecurityinformation-security+2

githubMar 6, 2026

How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework (opens in new tab)

GitHub Security Lab’s open-source Taskflow Agent uses AI-driven, multi-step auditing workflows to find high-impact vulnerabilities in web applications and open-source projects. The authors report more than 80 vulnerabilities, including authorization bypasses and private-data disclosures, with about 20 already disclosed. They argue that carefully designed taskflows and prompts can give LLMs enough freedom to discover vulnerabilities while reducing hallucinations and false positives. ## Running the Audits - The taskflows are available in the [`seclab-taskflows`](https://github.com/GitHubSecurityLab/seclab-taskflows) repository. - To run an audit: 1. Start a Codespace for the repository. 2. Wait for initialization. 3. Run `./scripts/audit/run_audit.sh myorg/myrepo`. - Audits may take one or two hours on a medium-sized repository. - Results are stored in SQLite and can be inspected in the `audit_results` table. - Rows marked with a check in `has_vulnerability` indicate potential findings. - A GitHub Copilot license and premium model requests are required. - The same repository should be audited multiple times because LLM results are nondeterministic; using different models may reveal different vulnerabilities. - Private repositories require changes to the Codespace configuration to grant access. ## How Taskflows Work - Taskflows are YAML files defining ordered tasks and dependencies for an LLM. - The `seclab-taskflow-agent` runs tasks sequentially and passes their results between stages. - Repository audits begin by dividing the codebase into functional components. - For each component, context is gathered, including: - Untrusted-input entry points - Intended privilege levels - Component purposes and behavior - This context is stored in a database for later auditing tasks. - Separate tasks can: - Suggest generic security issues - Carefully verify each suggested issue - Focus on specific vulnerability classes - Tasks can be reused across many components asynchronously through templated prompts and component-specific substitutions. ## Why Use Multiple Tasks - A single large prompt is less reliable because LLMs may omit steps in complex, multi-stage investigations. - Taskflows help control, debug, and structure the process even when models provide large context windows. - Breaking work into stages allows each result to be reviewed and reused as context for subsequent analysis. - Repeated task execution across components makes the approach scalable for large repositories. ## General Security Auditing - The team initially used the framework to triage CodeQL alerts, where strict instructions and predefined criteria helped limit false positives. - General auditing is more difficult because the LLM must search broadly for vulnerabilities rather than evaluate known alerts. - Greater freedom increases the risk of hallucinations and unexploitable findings. - The authors’ approach uses taskflow design and prompt engineering to preserve a high true-positive rate while allowing the model to investigate diverse security issues. ## Reported Vulnerabilities - The taskflows have found more than 80 vulnerabilities in open-source projects. - Many reported issues are high-impact, including: - Authorization bypasses - Information disclosure - Logging in as another user - Accessing private user data - Examples include exposing personally identifiable information in ecommerce shopping carts and authenticating to a chat application with arbitrary passwords. - The authors manually verify findings before reporting them and maintain an advisories page as disclosures become public. The practical recommendation is to run the open-source taskflows on your own projects, repeat audits with different models, and manually validate every result. The framework is intended to improve through shared taskflows, prompts, and findings across the security community.

open-sourcellmgithub-copilotprompt-engineering+4