Project
Self-hosted edition of GitHub that organisations run on their own infrastructure, tracking the hosted service's features on a separate release cycle.
GitHub says adding an AI classifier to push protection could more than double the secrets it can stop, by spotting passwords that have no fixed format. Push protection now stops about 30% of newly detected secrets before they reach repository history.
Reality
OpenAI's Codex now builds a project's environment once and starts each cloud task from it, with task state recoverable for up to seven days. For a team rolling it out, the new job is deciding who may edit the shared setup and what it can reach.
Reality
GitHub patched CVE-2026-77987, a GitHub Enterprise Server flaw that let an unauthenticated attacker read instance secrets by timing notebook viewer responses. The secrets could yield remote code execution, and with private mode off the attack needed no login.
Reality
Enterprise Cloud owners can now pull owner, scope, expiry and last-use data for SSH keys, PATs and app tokens as a CSV. The export stops at credentials GitHub issued, so secrets pasted into repositories stay out of scope.
Reality
GitHub's remediation tutorial treats a committed credential as compromised the moment it is exposed. It says automated scanners find publicly exposed secrets in minutes and attackers can use them within hours.
Reality
A CNCF walkthrough routes workflow_run and workflow_job events into an OpenTelemetry Collector, so CI coverage depends on org admin access rather than on who remembered to add a tracing step.
Reality