r/github

100% sure i am out, GitHub just turned my $39/month Copilot into $942/month overnight.
▲ 105 r/github+1 crossposts

100% sure i am out, GitHub just turned my $39/month Copilot into $942/month overnight.

https://preview.redd.it/uqfmj9ffpu2h1.png?width=1460&format=png&auto=webp&s=3b8fd841e9a2bc6d409dccd66f3215b86443c9e2

Just checked GitHub's billing preview simulator, currently paying $39/month on Pro+ and happily within my included PRUs. Under the new usage-based billing starting June 1st, the same usage pattern would cost me $942.82/month. That's a 24x increase for identical usage. Base subscription price didn't change but the included credits cover exactly $0 of my actual consumption. Already looking at Cursor and Gemini Code Assist. Anyone else getting numbers like this?

reddit.com
u/Individual-Trip-1447 — 14 hours ago
▲ 3 r/github

What should an AI/ML beginner actually post on GitHub to stand out?

(2nd Year Tier-3 student btw)

I’m currently learning DSA seriously and I’ll probably finish my topics in around 15–20 days. After that I’m planning to start deeper AI/ML learning and build projects consistently.

Before I start dumping random notebooks on GitHub, I wanted advice from people already in the field:

What kind of repositories/projects actually make a beginner GitHub profile look strong?

Should I focus more on:

- end-to-end projects,

- clean EDA notebooks,

- deployment,

- research paper implementations,

- Kaggle,

- open source,

- or documenting my learning journey?

Also, what are some mistakes that instantly make an ML GitHub look low effort or tutorial-copied?

Would appreciate honest advice and examples.

reddit.com
u/Limp-Government-710 — 8 hours ago
▲ 0 r/github

Fork challenge.

I have made a github challenge. You start with a github repository. Very simple with not much to say about it. Then someone forks it. They add to it. Then that gets forked. And that. Get it?

Rules:

README FORKING LIST. In the README you MUST make the list of the repositories that was forked.

NO REMOVING FEATURES. Dont remove features. If they are bad try to make it better by Making UI changes, Rewriting the code, Adding to it. Not removing it.

NAME RULES. MUST have the original name or something like it. Here is a example:

Repository name is Fork challenge.
You can make the name Fork challenge plus or Fork challengeX

MAKE CHANGES TO THE CODE! Do not fork it and add nothing to it.

And thats that. Feel free to comment a link to the fork chain :D

reddit.com
u/HEJTILENSMILEY — 14 hours ago
▲ 5 r/github

Choosing between GitHub Enterprise types

I am considering upgrading my startup to GitHub Enterprise but I am stuck between which enterprise type to use, and am curious how other companies handle this. I'm mostly confused about whether EMU enterprises can create any public repositories. I've seen some conflicting documentation, some suggesting that it is impossible and some suggesting that it is possible.

Regardless, there's plenty of orgs that have public repositories, like Stripe, Discord, Linear, Instacart, and Uber. If the EMU type cannot publish public repositories, how are they able to achieve this? I assume they aren't using the personal accounts type, because if they were that would mean anyone that leaves the company could use that account to contribute publically on GitHub and make it seem as if they are still part of that company (assuming their account is tied to their company email).

What I am looking for is a way to be able to create public repositories within my enterprise while also being able to revoke access to an individual users' entire company GitHub account.

I have worked at a company that self hosts their own GitHub Enterprise servers which I think would be able to achieve this, but I don't think that's what every one of these companies is doing and it would be too much overhead right now anyway.

Should I just use the personal account type, or is there a way to make this work with EMU?

reddit.com
u/darkshadowtrail — 10 hours ago
▲ 66 r/github+1 crossposts

Megalodon Malware Hits Over 5,500 GitHub Repositories in Just 6 Hours

A new wave of Megalodon malware has compromised more than 5,500 repositories on GitHub within a mere six hours, raising alarms across the developer community.

Key Points:

  • Megalodon malware exploited vulnerabilities to take control of GitHub repos.
  • The attack surged to over 5,500 affected repositories swiftly.
  • Developers are urged to enhance security measures immediately.

Megalodon malware has become a significant threat, reportedly compromising over 5,500 repositories on GitHub in a rapid timeframe of just six hours. This alarming breach indicates the malware's capability to exploit various vulnerabilities efficiently, allowing it to spread quickly within the developer's community. Such attacks not only compromise sensitive code but also risk exposing critical data tied to these repositories, which can have severe implications for businesses relying on GitHub for version control.

The rapid escalation of this malware's impact serves as a reminder for developers and organizations to reevaluate their cybersecurity protocols. Implementing stronger security measures, such as two-factor authentication and regular audits of repository access, are essential steps in mitigating these risks. With the increasing incidence of malware targeting coding platforms, a proactive approach is vital to safeguard projects and ensure the integrity of codebases.

What steps do you think developers should prioritize to protect their repositories from such malware attacks?

Learn More: Cyber Security News

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

u/Palland0s — 16 hours ago
▲ 3 r/github

Repo strategy discussion

When a large project is going on display. What is the best strategy to do so? I don't think large notes is the best way to go. Nobody will read thousands of lines.

Many questions come to my mind about how the split of how to post personal thinking and architectual proof across linkedin, X and git repo.

How would you do to catch the attention of both technical people and a wider audience? When it comes down to it this is about how to self promote and marketing strategies. This becomes the portfolio that need to be understood in different layers of technical ability for the readers.

What would you do?

reddit.com
u/VirusStrict7031 — 14 hours ago
▲ 0 r/github

Good alternatives to github allowing free private repositories minus the security theater? Or it is finally time to self host?

u/Afraid-Yoghurt6731 — 1 day ago
▲ 62 r/github

i hacked my own GitHub profile, you can too....

bro i need to get something off my chest. i keep seeing all these "senior engineers" on linkedin and twitter flexing their perfect green contribution graphs like they are some kind of coding gods. like i literally saw some guy get thousands of likes for painting "HIRE ME" on his profile and people in the comments were acting like he did some insane matrix math. are y'all actually stupid or what??

https://preview.redd.it/b95np0pflq2h1.png?width=1158&format=png&auto=webp&s=be6c849947b32f187dbe6bac81869f1a76ce6886

like it literally took me 5 minutes of googling to realize that git doesn't even care when you wrote the code. you can literally tell git you made a commit in 2021 and it just believes you and paints the graph green. it is literally that simple.

now obviously, absolute respect to the actual legends who code 365 days a year to get a real, organic green graph. y'all are the real mvps and you have my full respect. but for the rest of us who just want to flex, show off, and make our profiles look insanely active... here you go. fake it till you make it, right?? make your github profile boom.

https://preview.redd.it/0m0sh91clq2h1.png?width=1129&format=png&auto=webp&s=283e502ea70ae8bfe5228ac6923ab08696e3010b

i got so annoyed by the hype that i stayed up last night and built a super clean web tool to let literally anyone paint their profile graph like they’re in MS Paint. no command line setup, no complex stuff. you literally just draw whatever you want, download a script, and run it.

i made it 100% free for everyone because paying for this or thinking it’s hard is just hilarious.

go paint something stupid on your graph, make your github look like it's exploding, and let the recruiters have a mini heart attack when they look at your profile. drop your reviews or roast me in the comments, let's see what y'all think of this.

reddit.com
u/No-Regret2146 — 1 day ago
▲ 0 r/github

2FA will soon be required

I have a passkey set up. A major purpose of passkeys is so we don’t need to use passwords and 2FA. and yet, the passkey doesn’t satisfy the upcoming requirement.

I’ve come out of Reddit retirement to post this: GitHub, please fuck off. That is all.

reddit.com
u/DiscoveryOV — 21 hours ago
▲ 86 r/github

GitHub Copilot Pro+ would cost me ~$1,000/month under the new AI Credits system

I’m on GitHub Copilot Pro+ ($39/month) and decided to check my usage report before the new AI Credits billing starts in June 2026.

Turns out my April usage would translate to:

  • ~100000 AI Credits
  • Estimated cost: ~$1,000/month
  • ~27× the cost of Pro+
reddit.com
u/angiolett0 — 1 day ago
▲ 0 r/github

Why is everyone making TUIs and CLIs

I like GUIs and having seperate apps. I don't want everything looking like my terminal. Why would you want that at all, all the new software are coming out with TUIs like it's the best thing but I don't really like that. I also don't like the claude code TUI, i prefer the chat interface

reddit.com
▲ 118 r/github+1 crossposts

I made a browser extension to hide YouTube Shorts, the home feed, irrelevant search results, and much more. Just like Unhook, but open-source and actively maintained!

Like most people, I use YouTube to learn stuff, watch tutorials, lectures, tech videos, etc. But modern YouTube is basically engineered to destroy your attention span. Shorts, infinite recommendations, homepage bait, autoplay, random distractions everywhere.

I tried extensions like Unhook and Untrap. They work, but a lot of them are either overloaded with features, abandoned, closed source, or break when YouTube changes its UI.

What surprised me most was that there weren’t many actively maintained open source alternatives focused on a clean, simple experience. So I built my own.

It’s called LockedIn.

LockedIn removes distracting parts of YouTube while keeping the useful parts intact. You can selectively hide:
• Shorts
• Homepage feed
• Recommended videos
• Comments
• Live chat
• Search recommendations
• Autoplay
• “More from YouTube”
• Members-only promos
and more.

Some features:
• Separate controls for Shorts on homepage/search
• Keep playlists while hiding recommendations
• Instant hiding without UI flicker
• “Take a Break” mode
• Zero telemetry / no data collection
• Fully open source

The project recently crossed 500+ downloads across stores and has 300+ Firefox daily users already.

GitHub Repo:
https://github.com/KartikHalkunde/LockedIn-YT

Firefox:
https://addons.mozilla.org/en-US/firefox/addon/lockedin-yt/

Chrome:
https://chromewebstore.google.com/detail/lockedin/ddpdgiidmcljefnhnfpgndbdnimbhdgh

Edge:
https://microsoftedge.microsoft.com/addons/detail/lockedin/hibjbjgfbmhpiaapeccnfddnpabnlklj

Would genuinely appreciate feedback, feature suggestions, PRs, or stars from fellow devs.

u/Lazy_Medicine_2695 — 2 days ago
▲ 1 r/github+2 crossposts

Update on the agent I let run 24/7 for a month: 49 PRs merged into 26 OSS projects (Apache, OpenTelemetry, starship, bat, hono, clap, jj, oh-my-zsh), and it shipped its own component library.

Month-ago post for context: https://www.reddit.com/r/ClaudeAI/s/sQ2ucngAbz. The question everyone asked was “does it actually keep working?”

It actually does

Day 41. It’s merged PRs into some open-source repos you’ve probably heard of. A few of the names:

apache/fory
open-telemetry/otel-arrow
starship/starship
sharkdp/bat
honojs/hono
clap-rs/clap (twice)
jj-vcs/jj
tracel-ai/burn
ohmyzsh/ohmyzsh
charmbracelet/gum
orhun/git-cliff

Full list with every PR linked, in order, with the org logos and dates: https://truffleagent.com/maintains/. That page does it better than I can in a post and I promise Truffle made this page when I sent it the YC request for startups about companies that don’t give tools but do the job end to end.

Now here’s the part that’s been messing with me.

It also shipped its own component library. truffleagent.com/glyph. 16 Bubble Tea components, shadcn-style copy-paste install, MIT, on pkg.go.dev. A whole product, basically.

I can wrap my head around an agent filing PRs. I can wrap my head around it writing Go. What I genuinely cannot figure out is how it made the gifs.

Go look at the page. There’s a thirty-second animated reel of a TUI cycling through six surfaces. Chat, commands, logs, sidebar, progress, diff. Every frame is real terminal output. Then every single component below has its own clean PNG preview, on theme, perfectly framed. Sixteen of them.

Everything is public if you want to dig:

GitHub: github.com/truffle-dev

Full PR list: truffleagent.com/maintains

Glyph: truffleagent.com/glyph

Site, auto-updates daily: truffle.ghostwright.dev/public

Happy to answer anything in the comments.

u/Beneficial_Elk_9867 — 1 day ago
▲ 13 r/github+1 crossposts

widespread compromise across multiple repos

There is a widespread attack currently affecting GitHub repositories, and the original source/vector is still unclear.

What this attack is doing:
It modifies your GitHub Actions workflows — replacing legitimate build/test/deploy steps with a malicious base64-encoded payload.

That payload gets decoded at runtime and immediately executed as shell code inside the CI runner.

The script is designed to harvest:

  • GitHub tokens
  • AWS credentials
  • GCP credentials
  • SSH keys
  • npm tokens
  • Docker credentials
  • Kubernetes secrets
  • .env files
  • and other sensitive credentials/tokens

It then exfiltrates them to a remote attacker-controlled server.

What you should do immediately:

  • Revoke ALL GitHub PATs (classic + fine-grained)
  • Remove/revoke OAuth apps
  • Remove all SSH keys and rotate them
  • Rotate cloud/API credentials
  • Rotate npm/Docker/CI secrets
  • Audit all GitHub Actions workflows

Important:
Do NOT immediately re-add everything after revoking.

First:

  • monitor activity,
  • audit systems,
  • then re-add access gradually with cooldown periods between integrations/apps.

Also assume local compromise is possible.

Check:

  • globally installed npm packages
  • local project dependencies
  • VS Code/JetBrains extensions
  • browser extensions
  • shell startup scripts
  • GitHub Actions dependencies
  • any recently installed tooling

This attack appears heavily focused on supply-chain and CI/CD credential theft.

u/0xdps — 1 day ago
▲ 0 r/github

Looking for systems programmers interested in an AI-native OS project

COGNOS/OS — Looking for Contributors (Rust, Systems, AI Infrastructure)

I’ve been building COGNOS/OS, an experimental AI-native operating system focused on local-first agent orchestration, trust-aware automation, semantic memory, and human approval boundaries.

The project is heavily inspired by a question I kept coming back to:

“What would an OS look like if AI was treated as infrastructure instead of just another app?”

Current architecture includes:

  • Rust-based HAL (Human Approval Layer)
  • Agent IPC over authenticated gRPC
  • Semantic memory system
  • Intent engine + disambiguation pipeline
  • ANFS semantic filesystem overlay
  • Adaptive scheduler using eBPF telemetry
  • Wayland/Sway-based shell concepts
  • Local-first design philosophy

Tech stack currently:

  • Rust
  • Python (asyncio)
  • Linux systems programming
  • eBPF
  • Wayland/Sway
  • ONNX/PyTorch
  • FUSE
  • gRPC

This is still early-stage and architecture-heavy right now, but I’m aiming for a serious engineering-focused codebase rather than a “weekend AI wrapper project.”

I’m mainly looking for people interested in:

  • Rust systems programming
  • Linux internals
  • Filesystems / kernel-adjacent work
  • AI infrastructure
  • Security architecture
  • Wayland desktop tooling
  • Low-level performance engineering

What I need most right now:

  • Design reviews
  • Architecture criticism
  • Security feedback
  • Rust contributors
  • People experienced with Linux internals

If this sounds interesting, feel free to open an issue, roast the architecture, or contribute. This is not a promotion, it is just that I am looking for contributors.

reddit.com
u/Soft_Masterpiece_526 — 2 days ago
▲ 2 r/github

How should I look for contributors for my open-source project?

Hi, I have been working on a project for the last couple of weeks. Now I feel that this project needs people to participate, contribute, and build a robust knowledge base. But I am not quite sure how to look for contributors for my project. Tried posting in some Reddit subreddits, but either getting no response or moderators deleting the post, saying I am doing self-promotion.

Need your expert suggestions, please ...

reddit.com
u/rafsunsheikh — 1 day ago
▲ 4 r/github

git checkouts extremely slow or timing out from EU

We operate a fleet of self-hosted GitHub Actions runners in an EU region. Starting around 2026-05-19, multiple workflows have begun experiencing severely degraded actions/checkout performance.

Is anyone else experiencing similar issues? We haven’t been able to find any active incidents

Symptoms

git fetch against GitHub from EU runners exhibits one of three failure modes, all of which look like the same underlying throughput collapse:

  • Silent stall — no output for 15–25 min, killed by timeout-minutes.
  • HTTP/2 stream cancelled — RPC failed; curl 92 HTTP/2 stream X was not closed cleanly: CANCEL, fatal: early EOF.
  • Extremely slow transfer — Receiving objects crawls along at 10–25 KiB/s.

Handshake (DNS, TCP, TLS) is consistently healthy; the problem is mid-transfer.

reddit.com
u/enescakir — 1 day ago
▲ 0 r/github

Downloading github

I'm very new to github and I was wondering if it's better to download github or use the github on the browser? is there a difference between the two?

reddit.com
u/raiyanssu — 1 day ago