Don’t Ignore Those GitHub Security Alerts. Automate Them Into your Workflow
summary
Verizon Media runs 330 active projects and finds 81% fixed by upgrading when GitHub flags vulnerable dependencies. The team extracts alerts via GitHub GraphQL, pushes them into a database and creates tickets in JIRA using the Screwdriver CI pipeline, aiming for GraphQL → JIRA via Screwdriver automation. A public repo named github-security-alerts-workflow holds the prototype; gaps remain for private repos, API toggles, central dashboards and hiring a tools engineer to finish enterprise-scale automation.
AI-written summary · about
chapters (22)
- 0:00Intro
- 5:00Project Visibility
- 12:00What is Information Security
- 14:37Agenda
- 14:48What GitHub does right
- 15:25What does GitHub do
- 18:24Kudos to GitHub
- 19:07Its challenging
- 20:00Automation opportunity
- 20:14Private repos
- 22:10Buyer beware
- 23:32What we did
- 23:45Call for support
- 24:01Corporate perspective
- 25:44GitHub Security Alerts Workflow
- 27:09Help us
- 28:32Automate
- 28:55Security and Open Source
- 30:15Open Source vs Closed Source
- 30:34Thank you
- 30:49Contact Gil
- 34:48False Positives
related talks
21mOpen source security: advisories and workflows to keep open source secure
41mBake Security into your workflow with GitHub Advanced Security and AI
49mProtect Your Code with GitHub Security Features
38mFortifying Your Codebase with GitHub
52mSecurity as Code: A DevSecOps Approach
27mBuilding a Secure Open Source Project on GitHub
20mDeliver Secure Software with Azure Devops & Github
01h 02mDeveloping secure software with GitHub