Protect Your Code with GitHub Security Features
summary
Shows concrete setups and results: GitHub enforces commit signing via GPG/SSH/USB keys and Vigilant mode so pushes can be required to be signed; Dependabot updates run weekly, propose PRs with a compatibility score (example 75% pass rate) and can auto-create security-fix PRs from the NVD mapping; secret scanning matches tokens against 120+ providers and can block pushes or revoke leaked GitHub PATs; CodeQL builds a graph database, runs in Actions, emits SARIF, and finds ~80% of past JS vulnerabilities when run regularly.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:19Agenda
- 1:57Commit signing
- 9:38Demo
- 12:47Commit signing
- 16:50Dependabot
- 20:07Demo
- 24:53Dependabot
- 26:52Security alerts on dependencies
- 28:05Demo
- 34:29Security alerts on dependencies
- 35:24Secret scanning
- 41:20Demo
- 43:02CodeQL
- 45:45Demo
- 48:07Outro
related talks
58mProtect your code with GitHub security features
01h 02mDeveloping secure software with GitHub
38mFortifying Your Codebase with GitHub
41mBake Security into your workflow with GitHub Advanced Security and AI
27mBuilding a Secure Open Source Project on GitHub
48mAdvanced Security with GitHub without GitHub Advanced Security
39mA Guide to Securing GitHub Based on Lessons Learned
11mGitHub Advanced Security and GitHub Copilot: Working together to make security