A Guide to Securing GitHub Based on Lessons Learned
summary
F5’s OSPO standardizes GitHub orgs after acquisitions, audits hundreds of orgs with a scripted pipeline that runs scorecard and legitify, and measures scores (example repo rises from 4.4 to 4.6 after enabling Branch protection). Policies enforce MFA, least-privilege owners, branch protection, CodeQL/code scanning and Dependabot alerts; a demo org and operator playbook prove the workflow and tools work incrementally, with plans to automate self‑service and dashboards to scale across all strategic orgs.
AI-written summary · about
chapters (6)
- 0:00GitHub security management
- 7:40Security risks in GitHub
- 17:50Secure open source communities
- 23:25F5’s GitHub security policies
- 30:05Auditing GitHub with Scorecard
- 37:42Key takeaways and next steps
related talks
39mA Guide to Securing GitHub Based on Lessons Learned- 39mA Guide to Securing GitHub Based on Lessons Learned
49mProtect Your Code with GitHub Security Features
25mManaging a GitHub Organization: Tools, Tips, and Best Practices
48mAdvanced Security with GitHub without GitHub Advanced Security
17mNo More Walled Gardens: Removing Barriers with SCM...
58mProtect your code with GitHub security features
01h 02mDeveloping secure software with GitHub