Flipping the script on application security
summary
Claims that GitHub data show security threats scale linearly with size after analyzing 70 million lines and that the rate hasn’t improved in six years lead to concrete metrics: about 570 to 1 developer to researcher, only 5 percent trust automated SAST, and Microsoft reporting ~50% false positives in secret scanning. Built features include Dependabot opens pull requests to upgrade vulnerable deps which doubles fix velocity, secret invalidation on exposure, and integrated code scanning aiming for a 90% actionable fix rate.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:33State of application security today
- 2:56Challenges
- 10:54Developer First
- 12:44Credential Scanning
- 15:49Static Analysis
- 18:50Closing thoughts
related talks
53mFlipping the Script on Application Security
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
52mSecurity as Code: A DevSecOps Approach
32mCode Security Reinvented: Navigating the Era of AI
38mCode Security Reinvented: Navigating the era of AI
41mBake Security into your workflow with GitHub Advanced Security and AI
58mSecuring Code in the Age of AI
49mProtect Your Code with GitHub Security Features