GitHub Security for Open Source Projects: A Maintainer’s Guide to Dependabot, Secret Scanning, and CodeQL in 2026
After maintaining 15+ open source repos for three years, I'm sharing the exact GitHub security setup that stopped two supply chain attacks and cut our vulnerability window from