The LinkLoot Blog

Protect npm releases: high-impact accounts now get a 72-hour safety pause

GitHub has added a preventive 72-hour read-only state for high-impact npm accounts after sensitive account changes, closing a common supply-chain takeover path.

Run GitHub Actions steps in parallel without losing separate logs

GitHub Actions now supports parallel steps with background, wait, wait-all, cancel, and parallel syntax. It is useful for faster CI jobs, but teams should test composite-action support before refactoring shared actions.

Fix self-hosted Supabase auth routes before SAML breaks

Supabase is changing the default self-hosted API_EXTERNAL_URL to include /auth/v1 in the next self-hosted release, with SAML SSO route changes that teams should verify before upgrading.

Block Ivanti Sentry CVE-2026-10520 faster: Cloudflare WAF adds managed protection

Cloudflare has added a managed WAF rule for CVE-2026-10520, a critical Ivanti Sentry OS command injection flaw that CISA and NVD list as actively exploited.

6/27/2026 5 min

Harden GitHub Repos Now That Secret Scanning Blocks More Token Leaks

GitHub expanded secret scanning in June 2026 with new partner detectors, wider default push protection, validity checks, and richer leak metadata. The practical move is to audit which repositories actually have push protection and alert triage enabled.

6/27/2026 4 min