Developing secure software with GitHub
summary
Demonstrates concrete GitHub features and limits: secret scanning (scans history, public repos free, private repos need GitHub Advanced Security), push protection that blocks commits and auto-creates a locked issue, and vendor-integrated automatic revocation; CodeQL builds a code database for queries and scheduled static scans; dependabot opens upgrade PRs and groups updates. Notes paid extras: AI generic-secret detection and autofix are enterprise-only, and Azure DevOps equivalent (GitHub Advanced Security for Azure DevOps) runs about $50 per active committer/month.
AI-written summary · about
chapters (11)
- 0:00GitHub for secure software
- 3:15OWASP Top 10 threats
- 8:29Secure software lifecycle
- 14:57GitHub security automation
- 26:27Secret scanning in GitHub
- 31:04Code scanning with CodeQL
- 42:43Dependency scanning with Dependabot
- 46:02Defender for Cloud with GitHub
- 46:46Azure DevOps security features
- 57:40GitHub vs Azure DevOps future
- 1:00:12Q&A
related talks
46mShip-It safely with GitHub Advanced Security
49mProtect Your Code with GitHub Security Features
58mProtect your code with GitHub security features
41mBake Security into your workflow with GitHub Advanced Security and AI
01h 00mLearn Live: GitHub administration for GitHub Advanced Security
11mGitHub Advanced Security and GitHub Copilot: Working together to make security
48mAdvanced Security with GitHub without GitHub Advanced Security
27mBuilding a Secure Open Source Project on GitHub