🚨 [IMPORTANT] Security Updates for Apps and API Access on GitHub

[ghostinhershell]

GitHub has released new security updates that impact how apps and API access work on the platform. These updates are designed to further protect your repositories, data, and workflows.

What’s Changed?

• First, signing into GitHub Apps and OAuth Apps that are private or owned by Enterprise Managed User (EMU) accounts is now restricted unless you are a member of the organization or enterprise that owns the application.
• Second, we have tightened the definition of internal visibility when calculating the access an SSO-authorized token has within a multi-organization enterprise.

These updates prevent certain ways of accessing GitHub that a very small number of developers (less than 0.05%) were using, sometimes without realizing it. For now, we’ve made exceptions for apps and organizations that seemed to rely on these methods, and we’ve emailed their owners and admins with instructions on how to update their setup so everything keeps working smoothly.

Why the Update?

These changes are part of GitHub’s commitment to improving the security of your code and the broader developer ecosystem.

Learn More

For full details on what’s changed and how it may affect you, read the GitHub Blog Changelog post.

---

Questions or Feedback?

Are you a developer or admin impacted by these changes? Do you have questions about updating your app or API settings? Want to share your experiences or suggestions?

Please reply below! If you arrived here from the Blog article, this is the right place to discuss your questions and feedback with the GitHub Community team and product experts.

Thank you for helping keep GitHub secure!

[chogalesoham]

✅ What Has Changed?
GitHub has released two major security updates targeting GitHub Apps, OAuth Apps, and API access with SSO in Enterprise settings:

App login restrictions for GitHub Apps & OAuth Apps
Users can now only sign in to private or Enterprise Managed User (EMU) apps if they belong to the owning organization or enterprise. External users are blocked from accessing these apps unless explicitly permitted.
TECHCOMMUNITY.MICROSOFT.COM
+3
The GitHub Blog
+3
GitHub
+3

Tighter SSO token permissions across multi-org enterprises
GitHub now enforces a stricter definition of internal visibility when authorizing SSO-enabled tokens. This affects how tokens are scoped and what access they provide in enterprise environments.
GitHub Docs
+2
The GitHub Blog
+2
GitHub
+2

GitHub has exempted a small percentage of existing configurations (<0.05%) until affected admins can update their setups. Owners have received direct email notifications.
GitHub
The GitHub Blog

❓ Why These Updates Matter
These changes align app behavior with expected access controls, reducing unintended exposure.

They're designed to prevent weak authorization scenarios, especially where users could log in to apps they shouldn’t have access to.

Enhances overall security of GitHub apps and OAuth integrations in enterprise environments.
GitHub Docs
+11
GitHub
+11
The GitHub Blog
+11
The GitHub Blog

[mdbhm502]

اودي سحب البرامج Ldt وتوتير البرامج إلاCCL وتركيب العناصر في بعضه وتخريب البرامج الآتي وسيطره عليه ؟؟