A Guide to Securing GitHub Based on Lessons Learned
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 11:25· Room 3H (3JAUREGIA - Floor 3), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
F5 OSPO standardizes GitHub orgs using legitify and scorecard to audit orgs and repos, running scripts that produce JSON dashboards and badges. A test repo moves from about 3.5 to 7.1 by enabling branch protection and Dependabot, adding security.md, tightening Actions token permissions, and requiring CI; those changes are quick and effective. At scale the team uses template repos and rule sets to manage dozens of orgs and hundreds of repos.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 4:36GitHub security importance
- 11:56Software supply chain threats
- 19:42GitHub security tools
- 25:21Demo of security improvements
- 33:53Scaling security practices
- 36:43Lessons learned
related talks
40mA Guide to Securing GitHub Based on Lessons Learned
39mA Guide to Securing GitHub Based on Lessons Learned
49mProtect Your Code with GitHub Security Features
27mBuilding a Secure Open Source Project on GitHub
48mAdvanced Security with GitHub without GitHub Advanced Security
58mProtect your code with GitHub security features
38mFortifying Your Codebase with GitHub
17mNo More Walled Gardens: Removing Barriers with SCM...