From App Security to Dev Security – Shift left with GitHub Advanced Security
summary
Claims that shifting security into the developer experience reduces breaches by catching issues earlier and not slowing teams down. Demonstrations use CodeQL for dataflow-aware code scanning (example: Log4j-style checks), Secret Scanning with push protection and 80+ partner integrations, and Dependabot creating auto PRs with a ~90% compatibility score to update vulnerable dependencies. Cites supply‑chain attack vector (event‑stream/flatmap‑stream → Copay, >100 BTC stolen) and industry losses rising from $4.1B to $6.9B (2020→21). Continuous dev environments (prebuilt Codespaces) speed secure onboarding and testing.
AI-written summary · about
chapters (5)
- 0:00Start
- 4:55The event-stream incident
- 14:19Credentials Developer
- 26:11Combining CodeQL with the world's largest developer community gives next generation SAST performance
- 43:37Dependency Management
related talks
49mFrom Application Security to Developer Security
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
30mThe 3 Ways of DevSecOps – Making Shift Happen
19mFlipping the script on application security
49mPanel: From Code to Defense: Why Developers Are the New Security Leaders
22mShifting left, how security fits into the DevOps story
32mHow to fit Sec into DevOps without Security team
52mSecurity as Code: A DevSecOps Approach