GitHub

This week on Open Source Friday, we’re joined by Manfred Riem and Nicole Haugen to celebrate the 1.0.0 release of Spec Kit! We'll dig into the new features and capabilities of Spec Kit like programmable workflows, reusable bundles, a growing community, and so much more. We'll also touch on what goes into making a 1.0 release for an open source project. If you’re curious about open source, developer tooling, and how ideas turn into practical projects, this stream is for you. Catch up on the introduction to Spec Kit on a previous Open Source Friday: https://lnkd.in/eWjTPQTA

Pushes to GitHub grew nearly 3x over the past year. There's more code coming in than ever and more of it is written by agents. One in three pull requests now involves an AI agent, up from fewer than one in ten a year ago. At that pace, agents could be writing most of it within a year. Every one of those pushes can carry a secret. Once it's in git history, it's too late. You have to assume it's compromised and rotate it, and rotation is slow and painful. Manual revocation takes about 40 days on average. One in five takes more than 90. So the name of the game is prevention. Stop the secret before the push lands. Push protection already does that for tokens with a recognizable pattern. Unstructured secrets were the gap. A database password has no prefix, and telling it apart from a placeholder takes context. Context meant an LLM, and LLM latency made that impossible inside the push window. Those secrets only got caught after they were already in history. So we looked for an alternative, and we weren't married to any one technology. We ended up with a hybrid solution, where regex still casts the net for candidates and a small fine-tuned model makes the call from the surrounding code, in under 2 ms per batch. Then the team kept hill climbing on precision and recall until it beat the LLM pipeline it replaced, offline and online: - 13% higher precision, 19% higher recall - 11.5% higher acceptance from repo owners in an A/B test - 86% faster scans Now unstructured secrets get stopped at the push. That could more than double the number of secrets we prevent. Why it matters: https://lnkd.in/g6etMfxA How it works: https://lnkd.in/g7UcFuVd Proud of this team: Erin Havens for the product leadership. Batu Ozturkler, Shengyu Fu, Simona (Zhehui) Liao and the Applied Sciences team at Microsoft CoreAI for the research partnership. Robert Bolender, Krystal Mitchell and Ashwin Mohan for technical leadership, and Jarrod Schnapper for our experimentation pipeline. John Gregson for business planning. Colten Woo for marketing. Michael Badgett, Daniel Dunn, Jessica Schumaker, Adriana Babakanian, Gleb Irovich and Aakash Shah for bringing the model into developer surfaces.

We want to help keep the vibrant developer community connected in light of the Grace Hopper Celebration's cancellation. If you had plans to be in California this month, GitHub would love to welcome you to Universe (Oct 28–29 in SF). We’ve set aside 75 complimentary passes for those with a cancelled registration (1 per person please). DM us for details. We'll accommodate valid requests on a first-come, first serve basis.

Sydney joins us to talk about Deep Agents, an open source agent harness — an opinionated agent that runs out of the box. Extend, override, or replace any piece.

Psst, pass it around: We have a new and improved badge for GitHub Universe 2026 ✨ Grab your in-person pass and secure a badge. Can't make it? Sign up to join us virtually. ⬇️ https://lnkd.in/eQaaymFw

We recently redesigned our repository star history to make it more useful to maintainers. Now it provides trends without returning individual identities or requiring unbounded database work. Learn how production evidence and maintainer feedback shaped an API built around aggregate data, predictable pagination, and practical engineering tradeoffs. ⭐ https://lnkd.in/ezTxpftz

Cake is always open source #NationalDessertDay

Most tools give you a fixed set of screens and ask you to fit your work into them. Canvases in the GitHub Copilot app flip that around. 🎨 You describe the interface you need, and then the agent builds a live surface you can both use and update. A kanban board, a release checklist, an issue triage view, or a simple dashboard, shaped to how you work. Because a canvas is bidirectional, the agent updates it as it works while you click buttons, move cards, and adjust filters. Each canvas is saved as an extension, so your team can reuse it or you can keep a personal one. How to build your first canvas with /create-canvas 👇 https://lnkd.in/eJc-6WkA

Continuous fuzzing finds real bugs, but it still needs someone to write harnesses, watch coverage, and triage every crash. The GitHub Security Lab built the Fuzzing Taskflow to give that loop to an agent. You point it at a C or C++ repository, and it identifies entrypoints, analyzes the build, crafts harnesses, runs the AFL++ fuzzer, reads coverage, and creates a vulnerability report for each unique bug. Check out how the pipeline works end to end 🔍 https://lnkd.in/gfGYpkhh

In a new survey of 1,039 GitHub users conducted by GitHub and the Yale Program on Climate Change Communication, we found: • 80% were interested in tools for writing more energy-efficient code • 78% wanted to learn best practices for reducing software’s environmental footprint • 74% wanted ways to measure the environmental impact of their software or development process Developers want more efficient software. What many lack is a clear way to find waste, measure improvements, and make the case for fixing it. There’s an opportunity to turn that interest into normal engineering work. 💡 https://lnkd.in/ecVGpnqQ