skip to content
Back to
Home Bounties CodeQL Research Advisories Get Involved Events
GitHub Security Lab

Securing the world's software, together

GitHub Security Lab

Securing the world's software, together

GitHub Security Lab’s mission is to inspire and enable the community to secure the open source software we all depend on.

Follow @GHSecurityLab

What we do

Find vulnerabilities
Find vulnerabilities

Our researchers find and report new vulnerabilities in the open source projects everyone relies on.

Empower others
Empower others

We build tools like CodeQL to make security easy for anyone working to secure open source.

Foster collaboration
Foster collaboration

We're building a community of security researchers and an open coalition of the world's security teams.

Vulnerabilities we've disclosed

  • ReDoS in OpenProject - CVE-2021-32763
    GHSL-2021-098CVE-2021-32763 • published 2021/08/03 00:00:00 ago • discovered by team
  • Reflected Cross-Site Scripting (XSS) leading to Remote Code Execution (RCE) in Nuxeo - CVE-2021-32828
    GHSL-2021-072CVE-2021-32828 • published 2021/07/21 00:00:00 ago • discovered by Alvaro Munoz
  • DoS and RCE in totaljs
    GHSL-2021-066CVE-2021-32831 • published 2021/07/21 00:00:00 ago • discovered by team
  • Post-authentication Remote Code Execution (RCE) in ZStack REST API - CVE-2021-32829
    GHSL-2021-065CVE-2021-32829 • published 2021/07/21 00:00:00 ago • discovered by Alvaro Munoz
  • Command injection in @diez/generation - CVE-2021-32830
    GHSL-2021-061CVE-2021-32830 • published 2021/07/21 00:00:00 ago • discovered by Alvaro Munoz
266 CVEs found
by Security Lab researchers

Meet the team

Kevin Backhouse

Compilers, program analysis, security research

GitHub icon @kevinbackhouse twitter icon @kevin_backhouse
Man Yue Mo

Security scavenger

GitHub icon @m-y-mo twitter icon @mmolgtm
Agustin Gianni

Avoiding grep since 1999 AD

GitHub icon @agustingianni twitter icon @agustingianni
Antonio Morales

EthicalHacker­BugHunter & C++; 3735928559

GitHub icon @antonio-morales twitter icon @nosoynadiemas
Xavier René-Corail

3-legged race organizer: Building bridges between Dev and Sec

GitHub icon @xcorail twitter icon @xcorail
Hauwa Otori

Operations and coalition builder for security research

GitHub icon @hauwaotori twitter icon @hauwaotori
Bas Alberts

Debugging enthusiast

GitHub icon @anticomputer twitter icon @basalberts
Alvaro Munoz

Hacking since 1970-01-01T00:00:00Z

GitHub icon @pwntester twitter icon @pwntester
Jaroslav Lobacevski

Security panda

GitHub icon @jarlob twitter icon @yarlob
Robert Schultheis

I read your CVEs

GitHub icon @rschultheis
Shelby Cunningham

Security mostly, with privacy and retro if there's time.

GitHub icon @shelbyc twitter icon @shelbyc64
Jonathan Moroney

Seeking safer software

GitHub icon @darakian twitter icon @Hooray_Darakian
shape shape shape

Our tools

Our industry-leading code analysis engine, CodeQL, is now free for use on open source. CodeQL lets you query code as though it were data. Write a query to find all variants of a vulnerability, eradicating it forever. Then share your query to help others do the same.

Download CodeQL
mona puzzle

Join the effort

As a security researcher, your expertise is instrumental in securing the world’s software. Codify that knowledge as an expressive, executable, and repeatable CodeQL query that can be run on many codebases. Get rewarded for queries that have a positive impact on open source projects through our bounty program.

See our bounties

Our latest research

Keeping your GitHub Actions and workflows secure Part 3: How to trust your building blocks
August 5, 2021
Our shared common weaknesses
July 13, 2021
Fail2exploit: a security audit of Fail2ban
July 1, 2021