The industry-established code review process, review-then-commit, was a straightforward mechanism that allowed a relatively low-trust group of engineers to collaborate. It appears to have been initially developed for the Apache server OSS project in the 90s, corporatized by Google in the early 2000s, and popularized throughout the industry by several means, most notable of which was the GitHub PR.
Review the reviews
When I was actively contributing to the Go project, my primary feed was the code review email firehose. Issues, mailing lists, and Slack had low SNR. The finished commit history was better: it was finely polished work with some of the best written commit messages I have ever encountered. But it didn’t hold a candle to code reviews for operational learning. The commit history could tell you what got done and why, in impressive technical detail.
Software Is Made Between Commits
From the Zed Blog: Agents turned the conversation into the real source of our software. DeltaDB is the version control built for it.
Better tools made Copilot code review worse. Here's how we actually improved it.
How migrating Copilot code review to shared Unix-style code exploration tools reduced review cost by reshaping agent workflows around pull request evidence.
Ditching GitHub
This is going to be some sort of a public service announcement, withside notes. This has been brewing for a long, long time (years), it’sjust that I never se...
How We Exploited CodeRabbit: From a Simple PR to RCE and Write Access on 1M Repositories - Kudelski Security Research Center
Aug 19, 2025 - Nils Amiet -
Introducing the Open-Source Codex Security CLI
Codex Security helps security and engineering teams find, confirm, and fix vulnerabilities. Use its command-line interface (CLI) to scan repositories you own or have permission to assess, review findings over time, and check changes before they land. Quickstart Guide for an interactive scan Cloud set-up for connected GitHub repositories Link to the public repo: Codex Security This is an early release, and we’re listening to your feedback as we continue improving it. The Codex Security CLI ...
Jigsaw-Code/sensemaking-tools
Contribute to Jigsaw-Code/sensemaking-tools development by creating an account on GitHub.
A DEVELOPER MADE A REAL COMMIT WITHOUT EVER TYPING GIT ADD OR GIT COMMIT -- JUST TO PROVE THE COMMANDS YOU LIVE BY ARE A THIN SHELL OVER A DATABASE YOU'VE NEVER ONCE OPENED 55 minutes from Tim Berglund, a longtime Git teacher and GitHub evangelist, taking the tool apart down to https://t.co/vJNRCmSBb9
A DEVELOPER MADE A REAL COMMIT WITHOUT EVER TYPING GIT ADD OR GIT COMMIT -- JUST TO PROVE THE COMMANDS YOU LIVE BY ARE A THIN SHELL OVER A DATABASE YOU'VE NEVER ONCE OPENED55 minutes from Tim Berglund, a longtime Git teacher and GitHub evangelist, taking the tool apart down to… https://t.co/z8Tf4udInA pic.twitter.com/vJNRCmSBb9— slash1s (@slash1sol) June 4, 2026
A method for giving credit to organizations that contribute code to Open Source
By tracking organizational contributions in Git commits, we can give organizations more tangible reasons to fund open source and help sustain it over time.
A GitHub Issue Title Compromised 4,000 Developer Machines
A prompt injection in a GitHub issue triggered a chain reaction that ended with 4,000 developers getting OpenClaw installed without consent. The attack composes well-understood vulnerabilities into something new: one AI tool bootstrapping another.
Is GitHub Cooked?
Track GitHub service incidents and outages. Real-time stats, incident history, and downtime analytics.
Atmospheric Automated Development
Marking a piece of feedback 'planned' kicks off an autonomous coding agent that implements it and opens a draft PR. Built with userinput.app, airglow, and GitHub Actions, without touching the app.