First Bite

A secret is any credential that proves it’s you, such as an API key, a password or a token.

GitHub’s docs say that when secret scanning finds one exposed, the advice is to rotate the affected credential right away, because scrubbing it from Git history is time-intensive and often unnecessary once the credential is revoked (GitHub Docs: About secret scanning).

Try this: if you have ever pasted a key into a command, a chat or a config file, read our Claude Code Daily to see one place it can end up. New here? Start here.

SSH signs you in with a key pair instead of a password.

The private key stays with you and works like a password, and the public key goes on the machine you want to reach, in a plain text file called authorized_keys in your .ssh folder (administrator accounts on Windows use administrators_authorized_keys instead).

When someone connects, the SSH server checks their private key against the public keys it has, so a key in that file lets whoever holds its private half sign in (Microsoft Learn: key-based authentication in OpenSSH for Windows).

Try this: if you have an authorized_keys file, open it and make sure you recognize every key in it, then read our Cursor Daily for the key name to look for. New here? Start here.

A GitHub workflow is a small automated job that lives in your repository: a YAML file in the .github/workflows folder that runs when something happens, like a new pull request or issue, on a schedule, or when you start it by hand.

An action is a ready-made, reusable step that workflows plug in, such as pulling your code or setting up your tools, and GitHub Actions is the service that runs it all (GitHub Docs: understand GitHub Actions).

Try this: open the .github/workflows folder in one of your repositories and see which actions it uses, then read our OpenCode Daily if one of them is OpenCode’s. New here? Start here.

A security advisory is the “patch me” note for a piece of software. When a project finds a security hole, its advisory names the affected versions and the earliest version with the fix, so you know exactly what to update to.

Each one carries a severity: Low, Medium (also called Moderate), High or Critical.

On GitHub it also gets an ID that starts with GHSA- (GitHub Docs: what’s inside a security advisory). Try this: open our Pydantic AI web_fetch Daily and spot its severity and the version to update to. New here? Start here.

Hooks are house rules your agent can’t skip. A hook is a small command that Copilot cloud agent and Copilot CLI run at set moments: when a session starts, when you enter a prompt, or right before it uses a tool.

The before-a-tool one (preToolUse) can approve or deny that step (GitHub Docs: About hooks). Try this: peek in your repo for a .github/hooks/ folder, then read our Copilot CLI hooks Daily to see why an “ask” no longer freezes Autopilot. New here? Start here.