Stopping vulnerabilities at the source
summary
GitHub shows live use of CodeQL and code scanning embedded in Actions to stop bugs before merge, demonstrating a full scan that runs in about eight minutes, an analysis flow that reports 17 candidate taint flows in an Express app and surfaces a real code injection path, and a historical SQL injection in Concourse that would have been caught earlier. The system claims under 30% false positives with 70% of flags fixed in PRs, and queries are open source so new CVEs map to new reusable queries.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 1:06State of software security
- 3:13Introducing GitHub code scanning
- 4:39Code scanning demo and setup
- 8:55Handling false positives
- 11:52Behind the scenes of CodeQL
- 21:53Workshops and conclusion
related talks
52mSecurity as Code: A DevSecOps Approach
33mSecurity as Code: A DevSecOps Approach
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All
19mFlipping the script on application security
41mBake Security into your workflow with GitHub Advanced Security and AI
32mCode Security Reinvented: Navigating the Era of AI
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities
37mSecurity as Code: A DevSecOps Approach