Inside GitHub: How we hardened our SAML implementation

GitHub details a multi-step hardening of its SAML SSO: migrating to and validating the ruby-saml library with controlled A/B experiments, enforcing a stricter real-world–derived SAML schema to reduce parsing ambiguity, and adopting a dual-parser approach for defense-in-depth. The report explains risks like XML signature wrapping, the pitfalls of flexible SAML schemas, and why DTDs are rejected, showing how observability and iterative rollout decreased attack surface and increased resiliency without introducing customer-facing instability.