# incident response plan An incident response plan is a predetermined set of instructions or procedures for detecting, responding to, and limiting the consequences of malicious cyberattacks against an organization's information systems. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak tightened its security with the GitHub Secure Open Source Fund DevFeed: [Keycloak tightened its security with the GitHub Secure Open Source Fund]() Original publisher: [Read original article]() Author: Alexander Schwartz Published: 2026-02-17T00:00:00Z Content type: article Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [incident response plan](), [GitHub](), [GitHub Actions](), [GitHub Copilot]() Tags: [github-actions](), [github-copilot](), [idm](), [incident-response](), [incident-response-plan](), [java](), [javascript](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [saml](), [security](), [sso]() ### AI overview Keycloak describes security improvements informed by the GitHub Secure Open Source Fund training, including expanded CodeQL use, a refreshed incident response plan, and using GitHub Copilot to explain findings and suggest mitigations. ### Source excerpt Keycloak is the open-source IAM backbone for countless applications, and provides single sign-on, strong authentication and user federation across organizations. We were part of the GitHub Secure Open Source Fund Session 3, participated in the three-week training and gained insights into how other projects handle incidents and implement security best practices. 67 projects were part of the training, so we received a lot of feedback. What we improved For Keycloak, we strengthened several aspects of our security posture. My personal highlights were: Tighter control with CodeQL We already had CodeQL running for Java and JavaScript sources. The training gave us better insights into how it is working, and we cleaned up existing findings and enabled additional queries. A key takeaway for us: CodeQL can scan your GitHub Actions! Refreshing the incident response plan An incident response plan (IRP) helps you to get things right when a vulnerability is reported, you suspect a leaked credential, or some other security incident happens. We already had an IRP, but got feedback what other steps we wanted to add to it. We might even make parts of it public in the future to better collaborate with security researchers. Asking GitHub Copilot When analyzing for example CodeQL reports, it was helpful for us to ask GitHub Copilot to provide explanations and tips how to mitigate it. If you are a software developer or a user of Keycloak: When was the last time you reviewed your incident response plan? Looking forward Thank you to those who funded the training, and presented demos and tools. Special thanks to the GitHub security team that delivered several trainings and acted as security buddies during the program and answered individual questions! ## GitHub Secure Open Source Fund DevFeed: [GitHub Secure Open Source Fund]() Original publisher: [Read original article]() Author: Julien Déramond Published: 2025-08-10T08:40:00Z Content type: article Language: en Sources: [Bootstrap.com]() Topics: [Open Source](), [GitHub](), [Security](), [Maintainers](), [incident response plan](), [GitHub Actions]() Tags: [github](), [incident-response-plan](), [maintainers](), [open-source](), [open-ssf](), [secure-github-actions](), [secure-open-source](), [security](), [workflows](), [workshops]() ### AI overview Bootstrap team members Mark and Julien describe participating in the second round of GitHub's Secure Open Source Fund. The three-week program combined presentations, workshops, office hours, and project-specific work focused on strengthening open-source security, code, workflows, and processes. ### Source excerpt Mark and Julien recently represented Bootstrap in the second round of the GitHub Secure Open Source Fund this past June. The program is designed to programmatically and financially improve the security and sustainability of open source projects, and we were honored to be a part of it. GitHub brought together open source maintainers, security experts, and ecosystem partners for an intensive, hands-on learning experience. Throughout three weeks, we had a few days of mixed expert-led presentations, collaborative workshops, and dedicated office hours with security specialists. Between sessions, we had homework: concrete, project-specific actions to immediately strengthen our codebase, workflows, and processes.