Zero-day tracking
GitHub zero-day tracking
GitHub holds source and CI secrets. It is a Microsoft company on Azure. Supply-chain KEVs that name GitHub, npm, or Microsoft belong on one briefing.
Watch GitHub — freeLive SaaS KEV tracker
Why GitHub is on this watchtower
Snyk watches what you import. This watches the platform you import from. Different job. Name GitHub; Keep Track adds Microsoft and Azure edges.
What we watch
- Direct GitHub KEV / critical NVD matches
- npm as a child in the catalog
- Microsoft parent and Azure cloud-host on Keep Track
- No GitHub App, no repo contents
Suppliers behind GitHub
- Microsoft — parent
- Microsoft Azure — cloud host
Catalog vendors that inherit a hit on GitHub
- npm — parent
Matched KEV and critical CVEs
No catalog matches stored for GitHub yet. Ingest runs from CISA KEV every six hours. See the live tracker.
Questions
Is this Dependabot?
No. Dependabot is package CVEs in your repos. We alert when the GitHub product or its parent/cloud is in KEV.
Add GitHub to your stack.
Three tools free. Keep Track is $20/month for supplier blast-radius, full history, and a digest.