Post

It was great to get a sense of how GitHub's security experts think, including how to react, when to act, where to draw the line. Even more important now that there's an overwhelming flood of AI generated reports consuming maintainer human effort. tiangolo.com/open-source/...

FastAPI@fastapi.tiangolo.com

FastAPI was part of the @github.com Secure Open Source Fund. 🔒 It helped us ensure we follow best practices securing FastAPI and friends for everyone, including the code and open source management. 🙌 github.blog/open-source/...

github.blogWhat 50 open source projects taught us about security in the AI eraSee how the projects in the GitHub Secure Open Source Fund combined AI-assisted workflows, maintainer expertise, and more to improve project security.

Sebastián Ramírez

@tiangolo.com

I had very interesting conversations with GitHub's security team and other open source maintainers, some of which inspired rebuilding some of the tools used to manage the repos to increase security even more. I recently made several new tools we are now using:

13/8/26, 4:46 pm0 reposts0 likes

Sebastián Ramírez

@tiangolo.com

13 Aug

Latest Changes: github.com/tiangolo/lat... To automatically update release notes in our projects. Now using a dedicated GitHub app, to use short lived tokens, and to limit branch protection rule exceptions to the minimum needed. You could install or self-host.

Sebastián Ramírez

@tiangolo.com

13 Aug

PR Push: github.com/tiangolo/pr-... To update PRs, for example for pre-commit (or prek) running on branches in the same repo (still use pre-commit.ci for forks). Also a GitHub app, short lived tokens. Install or self-host.

Sebastián Ramírez

@tiangolo.com

13 Aug

PR Submit: github.com/tiangolo/pr-... To create new PRs, e.g. to run on a schedule to update repo data files, etc. Also a GitHub app, short-lived tokens. Install or self-host as well.