Back to GitHub.com
Home Bounties Research Advisories Get Involved Events
GitHub Security Lab

Securing the world's software, together

GitHub Security Lab

Securing the world's software, together

GitHub Security Lab’s mission is to inspire and enable the community to secure the open source software we all depend on.

Follow @GHSecurityLab

What we do

Find vulnerabilities
Find vulnerabilities

Our researchers find and report new vulnerabilities in the open source projects everyone relies on.

Educate the community
Educate the community

We share our research through proof-of-concepts, articles, tutorials, conferences and community events.

Amplify security research
Amplify security research

We scale the security research of our community by performing Variants Analysis for open source projects with CodeQL.

Notify the ecosystem
Notify the ecosystem

We curate a database of CVEs and security advisories to notify open source developers and maintainers.

Our principles

Empower others
Empower others

Make securing open source easy for developers and maintainers.

Foster collaboration
Foster collaboration

Build a community of security researchers to serve the global open source community.

Vulnerabilities we've disclosed so far

  • Server-Side Request Forgery (SSRF) and Path Injection in Metersphere - CVE-2022-23544, CVE-2022-23512
    GHSL-2022-132_GHSL-2022-133 • CVE-2022-23544 • CVE-2022-23512 • published 2023/01/26 00:00:00 ago • discovered by Jorge Rosillo
  • Arbitrary file upload and download in act - CVE-2023-22726
    GHSL-2023-004 • CVE-2023-22726 • published 2023/01/20 00:00:00 ago • discovered by Kevin Stubbings
  • Arithmetic overflow in sysstat - CVE-2022-39377
    GHSL-2022-074 • CVE-2022-39377 • published 2023/01/20 00:00:00 ago • discovered by Kevin Stubbings
  • Use-after-free (UAF) in the Arm Mali Kernel driver - CVE-2022-38181
    GHSL-2022-054 • CVE-2022-38181 • published 2023/01/20 00:00:00 ago • discovered by Man Yue Mo
  • Bearer token disclosure in ghinstallation - CVE-2022-39304
    GHSL-2022-061 • CVE-2022-39304 • published 2022/12/22 00:00:00 ago • discovered by team
See all disclosures
shape
shape
377 CVEs found
by Security Lab researchers
254 since March 2020

Meet the team

Xavier René-Corail

3-legged race organizer: Building bridges between Dev and Sec

GitHub icon @xcorail twitter icon @xcorail
Antonio Morales

EthicalHacker­BugHunter & C++; 3735928559

GitHub icon @antonio-morales twitter icon @nosoynadiemas
Sylwia Budzynska

*hacker voice* I’m in

GitHub icon @sylwia-budzynska
Madison Oliver

Security transparency advocate

GitHub icon @taladrane twitter icon @taladrane
Chamari Tucker

Hacker where? Hacker there.

GitHub icon @callmeMari
Alvaro Munoz

Hacking since 1970-01-01T00:00:00Z

GitHub icon @pwntester twitter icon @pwntester
Shelby Cunningham

Security person with a dash of data privacy

GitHub icon @shelbyc
Ron Wochner

Breaker of things, fixer of some, curator of many.

GitHub icon @ronwoch
Kevin Backhouse

Catching up on all the hacking that I should have done in the 1990s

GitHub icon @kevinbackhouse twitter icon @kevin_backhouse
Phil Turnbull

security shenanigans

GitHub icon @philipturnbull
Peter Stöckli

Helping developers by breaking things.

GitHub icon @p- twitter icon @ulldma
Michael Stepankin

get shell or die trying.

GitHub icon @artsploit
Nancy Gariché

Community Building as Secure Code

GitHub icon @nanzggits
Joseph Katsioloudes

Making security easy for developers

GitHub icon @jkcso twitter icon @jkcso
Jaroslav Lobacevski

Security panda

GitHub icon @jarlob twitter icon @yarlob
Man Yue Mo

Security scavenger

GitHub icon @m-y-mo twitter icon @mmolgtm
Hauwa Otori

Operations and coalition builder for security research

GitHub icon @hauwaotori twitter icon @hauwaotori
Jonathan Moroney

Seeking safer software

GitHub icon @darakian twitter icon @Hooray_Darakian
Jorge Rosillo

while true; do ./research; ./ctf; done

GitHub icon @jorgectf twitter icon @jorge_ctf
Kevin Stubbings

Alright get out. From now on I'll do the memory managing around here.

GitHub icon @Kwstubbs
shape shape shape
mona puzzle

Join the effort

As a security researcher, your expertise is instrumental in securing the world’s software. Codify that knowledge as an expressive, executable, and repeatable CodeQL query that can be run on many codebases. Get rewarded for queries that have a positive impact on open source projects through our bounty program.

See our bounties

Our latest research

Coordinated vulnerability disclosure (CVD) for open source projects
A comprehensive guide for vulnerability reporters.
Nancy Gariché
February 9, 2022
Fuzzing sockets: Apache HTTP, Part 3: Results
In the finale of the Fuzzing sockets series, Antonio shares the results of his research on Apache HTTP server.
Antonio Morales
December 21, 2021
Getting root on Ubuntu through wishful thinking
How to exploit a double-free vulnerability in Ubuntu's accountsservice (CVE-2021-3939).
Kevin Backhouse
December 13, 2021
See all our articles