GitHub’s new ruleset can block pull-request merges until selected secret-scanning alerts are resolved, adding a review-stage guard beyond push protection.
A campaign beginning in late June 2026 built hundreds of fake brand repositories on GitHub and used SEO to place them at the top of software download searches.