Securing the Software Factory
summary
Claims concrete metrics and built features: GitHub reports 90% of the Fortune 100 on platform and uses data from 200 million projects to calculate a compatibility score for dependency updates, and dependency fixes land 4.5× faster when surfaced as dependency update PRs. Secret scanning blocks pushes of known tokens and reduces false positives by using provider-specific patterns. CodeQL runs ~2,000+ queries at every pull request, automatically finding and patching dozens of variants in the NASA-like example.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:39Securing software early
- 3:22Application security challenges
- 4:47Developer security training
- 5:29Security vs. speed conflict
- 6:55Cost of delayed fixes
- 8:00Developer-first security
- 9:04Dependency vulnerability scanning
- 10:51Seamless dependency updates
- 12:15Exposed security tokens
- 13:39Reducing secret scan false positives
- 14:41CodeQL automated analysis
- 16:31CodeQL dangerous patterns
- 17:36Integrating security in workflow
- 18:18Benefits of shifting left
- 18:39Call to action
related talks
19mFlipping the script on application security
38mFortifying Your Codebase with GitHub
30mSecuring the software supply chain together
16mFortify Your Code: Secure Your Supply Chain with Scorecard
25mFlagship Projects: Dependency Track
53mFlipping the Script on Application Security
49mProtect Your Code with GitHub Security Features
24mDependency Track Fortifying The Supply Chain