Story
What does GitHub's security team even do?
1 report
1 website
1 discussion
Latest report
Overview
Thousands of repositories on GitHub are currently distributing malware, accessible through the standard search function without special knowledge. Despite having a substantial budget, a dedicated security team, and AI resources, GitHub has not resolved this issue over the past two years.
Summary from orchidfiles.com.
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
orchidfiles.com
What does GitHub's security team even do?
Read report →
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · orchidfiles.com
Hacker News discussion ↗
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-07-27.
- Praise: Improvements to GitHub Actions security show that pressure can lead to real change, though it feels like we need more pain first.
- Praise: Some commenters see potential for package managers like PyPi to take a stand against insecure projects, which could force GitHub to step up its game.
- Praise: The discussion hints at a need for stronger incentives for security teams, like tying executive bonuses to security performance.
- Concern: GitHub's response time to malicious repositories is often lackluster, pointing to a resource starvation issue rather than incompetence.
- Concern: The sentiment that Microsoft may want to slowly kill the GitHub brand raises serious concerns about the platform's future and commitment to security.
- Concern: Security is viewed as a cost-center, leading to a lack of investment until incidents start impacting revenue — this is a dangerous mindset.