🚧 Main Branch: The One Where GitHub Sets Boundaries - Issue #36

Hiya friends,

Three things shipped this stretch that all come down to the same idea: control over defaults. GitHub gave orgs a way to cap open PRs, gave security teams a way to standardize code scanning without hand editing every repo, and gave OAuth apps more room to breathe with redirect URIs and token refresh. None of it is flashy. All of it saves someone a Friday afternoon.

🚢 What Shipped

Set pull request limits at the organization level

You can now cap how many open pull requests a contributor without write access can have at once, set once at the organization level instead of repo by repo. It lives under org Settings → Moderation options → Interaction limits. Useful if you maintain open source at scale and are tired of spam PRs eating review time across dozens of repos.

Customize code scanning default setup at scale

Code scanning’s default setup now accepts your own CodeQL configuration file through a new github-codeql-config-file repository property, so you can point every repo in an org at a shared config instead of clicking through settings one repo at a time. It’s live now on github.com, with GitHub Enterprise Server support landing in 3.23. If default setup felt too generic for your security team’s needs, this is the fix.

Multiple redirect URIs and token refresh for OAuth apps

OAuth apps can now register up to ten redirect URIs instead of one, with wildcard matching configurable per URI, and opt into short-lived access tokens plus a six-month refresh token via the offline_access scope. Worth checking your own app: if you only ever had one redirect URI, wildcard matching was on by default as legacy behavior, and it’s now visible and something you can turn off.

📖 What I’m Reading

watermarks-remover by Guillaume Meyer (his take on X)

I read through Guillaume’s README expecting a tool pitch and got something closer to an essay. He’s built an agent skill that strips AI provenance marks from your own content, and his section on what removal actually costs is the most interesting part: rewriting text to beat a statistical watermark degrades the writing, and he’s blunt about it, right down to asking why you’d pay for a premium model just to run its output through a cheaper one afterward. It reads like someone who thought hard about the tradeoffs before shipping, not someone selling a magic eraser.

Anthropic’s own watermarking rollout this month is why I kept thinking about that section. Claude-generated text now carries an invisible watermark by default, and Anthropic’s documentation admits the mark proves processing, not authorship, since someone can use Claude to translate, edit, or summarize their own work and the result still carries the mark. I translate this newsletter’s intro into Simplified Chinese with Claude every week, then publish it through the Beehiiv MCP server, also via Claude. By that logic, my own writing picks up a flag it doesn’t deserve. This is what I love about open source: Guillaume saw that gap and built a tool instead of just arguing about it.

Worth your time if: you’ve ever wondered what “AI detection” actually measures, or you maintain content pipelines that touch AI-generated drafts.

🔧 What I’m Using

Maintaining Team X-Ray taught me the hard way that agents won’t read your docs unless you tell them to. I’ve moved to scoped, directory-level AGENTS.md files instead of one README, so a rule like “this component needs a Storybook test” lives right next to the code it governs, not three folders up where an agent won’t find it before it picks a tool.

Nicholas Tindle arrived at the same place maintaining AutoGPT, 180,000 stars, 150 open PRs, a big chunk written by agents. I wrote about how he handled it on the GitHub Blog earlier this month. The short version: placement matters as much as the instructions themselves.

✨ This Week

This week I’m home from RenderATL, and I honestly cannot sing that conference’s praises enough. The OpenJS Foundation ran a Node.js Interactive track there, including a Code and Learn session where folks submitted their first ever PRs to the project with mentorship from Node.js core team members like Matteo Collina (@matteocollina), James Snell (@jasnell), Claudio Wunder (@wunderacle), and Ethan Arrowood (@arrowood.dev). I gave a talk and got to catch up with old friends from the Node community, the same community I called one of the most welcoming in tech back at my first ever talk in 2019. I still love this community, and I’m proud and grateful I got to support the foundation.

With gratitude, I’ll see you next week, Andrea

📌 P.S.

Colombia’s coffee region is still digging out from the 7.4 quake. 281 confirmed dead, more than 12,000 homes destroyed. My family is there.

Asociación de Bancos de Alimentos has food moving into Pereira, Armenia and Manizales today: donahoy.abaco.org.co/colombia2026

If your company has a donation match, this is the week to use it. Most people never touch theirs.

💛 Support

Subscribe to Main Branch • Sponsor on GitHub