michael_nielsen

This feature appears to only suggest updates to new revisions of dependencies. So if you already trust the upstream dep wouldn’t you also trust the fix in that upstream? Also, read your deps.

Few things that I ensure for all repos. - Enable only signed commits - Enable security analysis for incoming PR - Enable passing security analysis as mandatory presubmit requirement before merging This atleast helps to bring down the scope of malicious actors on the platform.

Review the code.

This already exists... you can send a PR now for basically anything and because the JS of node modules is obfuscated/transpiled it's somewhat hard to track down whether there's a vulnerability. But I agree it's important to think of these new novel attack vectors.

I’d argue this vector always existed and that the new bot brings more awareness. This is both good and bad for phishing and is probably net neutral. Overall though it’s probably benefit github to star verifying some accounts.