Ruby Central July Update

alpha/engagements/2026/Ruby Central/2026-07.md

@@ -0,0 +1,40 @@
+# July 2026
+
+Before we get into the specifics of our July update, we should mention there were two events that impacted our team’s time. First, we spent approximately two weeks handling a [major security advisory](https://blog.rubygems.org/2026/07/22/security-advisory-legacy-api-key-leak.html).  On July 22, we published a security advisory disclosing a CDN caching bug that could have exposed legacy RubyGems.org API keys, affecting users who signed in with a gem client older than v3.2.0, including the version vendored with current macOS. We revoked over 150k legacy keys and smoothly rolled out notifications to all affected users. Community feedback was positive. Given the blast radius of this advisory, it had the potential to be disruptive. Our careful planning and coordination made this a smooth and positive event. Great job to the team\! 
+
+Second, several members of the team attended [RubyConf](https://rubyconf.org/), including giving a [workshop](https://rubyconf.org/schedule/#wednesday) on improving package security with AI scans. Patrick Linnane and Andrew Nesbit joined Colby to walk gem maintainers through the full security lifecycle: understanding what a strong security posture looks like, running a scan on their own project, interpreting the results, and triaging findings with strategies ranging from quick fixes to longer term hardening.  It was well-attended and the team got positive feedback on how useful the content was.
+
+## Private Beta for Organizations
+
+Marty onboarded two new organizations, with two more in the onboarding queue.  This puts us at 14 active organizations.  Brian worked on streamlining the Organization creation flow based on customer feedback.
+
+## Package Repository Security
+
+### Transparency Log
+
+As mentioned above, RubyConf and the security advisory took most of this month, so there's less to report than usual. The work that did happen was on refining the Transparency Log API in the rubygems.org codebase. It's the contract that lets us begin recording ownership events (an owner added, removed, or a gem transferred). Next month we'll start developing the API that will allow anyone to verify the history themselves.
+
+## AI Security Engineers in Residence
+
+Scanning volume grew substantially this period. We identified 26 potential issues, of which 7 have been confirmed as genuine, and the number of projects under coverage more than tripled from 16 to 57\.  Severity has been mild throughout, nothing critical or high and we've had no embargo breaches.
+
+[Kou](https://github.com/kou), our Ruby Core member, worked on three notable issues. In Prism, he identified an out of bounds write problem that could crash a Ruby process; while it is not considered critical since general users do not parse untrusted Ruby programs, Kou proposed patches that informed the [maintainers' eventual](https://github.com/ruby/prism/pull/4172) [fixes](https://github.com/ruby/ruby/pull/17940) for both the original issue and a follow up problem in that fix. In strscan, he found an out of bounds read problem that could also crash a process, though it is not exploitable by remote attackers, and this was [resolved](https://github.com/ruby/strscan/pull/212) via a fix he contributed. In Racc, he addressed a case where eval was used to parse a string literal, [replacing](https://github.com/ruby/racc/pull/333) it with a safer parsing approach, even though this was not classified as a security bug since general users do not process untrusted Racc input. Looking ahead, Kou plans to review the current IO::Buffer implementation in CRuby from a stability and security standpoint, with the goal of moving it beyond its current experimental status.
+
+Time was spent on programmatic evaluation of AI scanner outputs, a prerequisite for the higher-throughput batch scanning planned for next period, as well as on deepening the Scrutineer native extension support for Ruby. Matt also spent some time on refactoring an internal harness to manage large-batch headless runs of Scrutineer.
+
+We landed 50 commits in the [scrutineer](https://github.com/alpha-omega-security/scrutineer) codebase in July, covering defence-in-depth against hostile repos, deepening Ruby native extension scanning and packaging/automation.
+
+[Patrick](https://github.com/p-linnane) closed three attack paths from a scan’s own agent: 
+
+- Rate-limited and de-privileged the scan-token API so a prompt-injected agent can't queue-bomb or forge audit verdicts  
+- Added a dial-time IP check to the egress proxy to stop DNS rebinding onto host-local services  
+- Stopped x-api-key following cross-origin redirects.
+
+Patrick also improved the release automation and shipped standalone binaries with scanning profiles embedded, which removes most of the setup burden for anyone adopting Scrutineer. 
+
+Scrutineer is now also [live in Homebrew](https://formulae.brew.sh/formula/scrutineer#default). 
+
+[Dushan](https://github.com/dkw-oss) worked on improving scan quality, deepening the native-extension and Rails profiles so that memory-safety issues in compiled gems are actually caught rather than silently skipped, and making the findings interface sortable and more easily navigable with a large findings volume. 
+
+Scans now also resume on their own after rate-limit interruptions, which materially reduces the babysitting cost of long-running batch work, directly relevant to the higher-throughput scanning we're moving toward. 
+

alpha/engagements/2026/Ruby Central/README.md

@@ -14,6 +14,7 @@ Our engagement with Alpha-Omega focuses on improving security in the Ruby ecosys
 * [April 2026](2026-04.md)
 * [May 2026](2026-05.md)
 * [June 2026](2026-06.md)
+* [July 2026](2026-07.md)
 
 ## Primary Contacts