OpenAI does not allow ChatGPT Business and Enterprise users to export their workspace chats through its standard data export option, prompting freelance journalist Conrad Quilty-Harper to create an unofficial solution. Quilty-Harper published scrapemychats on GitHub this week, a free tool that enables affected subscribers to retrieve their chat records. The tool works through a logged-in browser session, storing conversations and attachments in a local archive with an HTML interface that can be accessed offline. OpenAI's help page confirms that Free, Plus, Pro, and some Edu customers can export chats, whilst Business and Enterprise workspaces lack this functionality. Enterprise admins can access logs through OpenAI's Compliance Platform, but these are retained for only 30 days. The tool navigates through ChatGPT accounts and downloads conversation data, though the process is slow due to OpenAI's throttling measures.

42Crunch has launched an API Security Testing Plugin for GitHub Copilot, enabling developers to audit, test and remediate API security vulnerabilities within AI-assisted development workflows. The plugin addresses growing concerns that AI-generated code often contains security flaws, with Veracode reporting 45% of AI-generated code includes known OWASP Top 10 vulnerabilities. The plugin continuously audits OpenAPI specifications, detects security vulnerabilities, identifies OWASP API Security Top 10 risks, and provides AI-assisted remediation guidance. It aims to ensure security validation scales alongside AI-assisted development rather than becoming a bottleneck. CEO Jacques Declas stated organisations need "deterministic security guardrails that can validate, govern and remediate API security issues at the same speed AI generates them". The plugin is now available to 42Crunch's user base of over two million developers.

GitHub's npm package registry has introduced staged publishing, a security measure requiring maintainer approval before package distribution. The feature, now merged into npm CLI v11.15.0, addresses supply chain vulnerabilities where attackers compromise maintainer accounts to distribute malware through widely used packages. Staged publishing allows developers to submit packages to a staging area using "npm stage publish" rather than publishing directly. A maintainer must then review and approve the package via two-factor authentication before it becomes publicly available. The feature particularly benefits automated workflows, which typically lack 2FA authorization and rely on tokens that can be stolen. Combined with GitHub's trusted publishing using OpenID Connect authentication, staged publishing strengthens the software supply chain, provided developers implement these tools.