Coding Tools
GitHub Enhances Code Scanning Customization
GitHub Changeloghigh confidence
Why it matters
- →Provides granular control over security scans without extra workflow maintenance.
- →Enables centralized security configuration management across repositories.
- →Offers flexibility for organizations to tailor security settings as needed.
GitHub has rolled out a new feature that lets developers customize their CodeQL code scanning setup using a configuration file. This enhancement allows for detailed control over security scans without the need for individual GitHub Actions workflows in each repository. Organizations can maintain a central configuration file, ensuring consistent security practices while allowing for repository-specific adjustments. This feature is now available on GitHub.com and will be included in GitHub Enterprise Server 3.23, offering a scalable solution for managing security across multiple repositories.
Read originalThe story around this
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
How we got here
- 1GitHub Adds AI Security Detections to Pull Requests
GitHub Changelog · July 14, 2026 · Same story
What happened next
- 2CodeQL 2.26.4 Enhances Security Detection
GitHub Changelog · September 3, 2026 · Same story
More from GitHub Changelog
© GitHub ChangelogCoding Toolscoding
GitHub rate limits private vulnerability reports
GitHub is finally capping the flood of automated junk hitting maintainers' inboxes. By enforcing daily per-user limits on new private vulnerability reports, the platform stops bad actors from burying legitimate security findings under noise. Admins can now set custom caps or whitelist trusted researchers, ensuring that actual threats get seen. This shifts the burden from manual triage to automated gating, protecting open source maintainers without blocking genuine disclosures.
GitHub Changelog
© GitHub ChangelogMore in Coding Tools
Coding Toolscoding
Claude Code v2.1.286 patches security and session stability
Anthropic quietly fixed a critical credential leakage bug where MCP error messages were exposing raw API keys in plaintext logs. Beyond the security patch, this release stabilizes the notoriously fragile background agent system by fixing subagent hand-offs and connection stalls that previously caused silent failures. The update also tightens session management for cloud environments, ensuring large transcripts actually load instead of hanging indefinitely. It’s a maintenance-heavy release, but essential for anyone running complex, multi-step automated workflows.
Claude Code Releases
Coding Toolscoding
Claude Code v2.1.287 adds plugins and fixes
This update shifts Claude Code from a simple CLI wrapper to a more extensible platform by introducing 'Claude Mods,' allowing plugins to modify deeper behavior rather than just adding tools. The inclusion of a built-in 'You should know' side agent that flags potential oversights is a notable step toward autonomous oversight within the coding workflow. Beyond features, the release addresses critical stability issues in remote sessions and significantly improves accessibility for screen reader users, making the tool more robust for enterprise and diverse developer environments.
