{"id":82400,"date":"2025-02-07T09:00:17","date_gmt":"2025-02-07T17:00:17","guid":{"rendered":"https:\/\/github.blog\/?p=82400"},"modified":"2025-02-07T10:45:39","modified_gmt":"2025-02-07T18:45:39","slug":"from-finding-to-fixing-github-advanced-security-integrates-endor-labs-sca","status":"publish","type":"post","link":"https:\/\/github.blog\/security\/from-finding-to-fixing-github-advanced-security-integrates-endor-labs-sca\/","title":{"rendered":"From finding to fixing: GitHub Advanced Security integrates Endor Labs SCA"},"content":{"rendered":"\n

It’s no wonder developers are increasingly overwhelmed. The number of new CVEs published each year<\/a> has increased by nearly 500% in the last decade. And the average project, with just 10 direct dependencies, can have hundreds of indirect dependencies. Put simply, developers are often buried under a mountain of security alerts and unable to prioritize which ones to remediate first.<\/p>\n

While high-profile supply chain attacks like last year’s XZ Utils backdoor tend to capture attention, the danger they pose is just a fraction of the overall threat landscape. The bigger risk often comes from unpatched vulnerabilities in lesser-known open source dependencies.<\/p>\n

GitHub’s partnership with Endor Labs cuts through the noise to help developers accurately<\/em> identify, remediate, and fix the most critical vulnerabilities—without ever leaving GitHub.<\/p>\n