Advanced Security with GitHub without GitHub Advanced Security
summary
Claims that many GitHub security features are off by default and actionable fixes exist: enable require pull requests, turn on branch protections that dismiss stale approvals and require the most recent review, enforce MFA — the presenter cites that 90% of incidents could be avoided by MFA. Use dependency-review action and OSSF Scorecard, pin actions to commit SHAs or vendor critical libs, weigh vendoring costs, rotate secrets immediately, protect admin accounts, and note real attacks (event-stream ~1.9M installs, xz-utils backdoor) as concrete reasons to change defaults.
AI-written summary · about
chapters (11)
- 0:00GitHub security basics
- 3:16Developers and security vigilance
- 9:50Developer workflow risks
- 11:14Threat modeling adversary view
- 17:54Protecting source code in GitHub
- 26:26Code review security pitfalls
- 26:47Dependency threats and supply chain
- 35:38GitHub security configurations
- 37:03Secure by design principles
- 38:07Developer security tips
- 42:04Q&A on AI and SSH
related talks
01h 02mDeveloping secure software with GitHub
41mBake Security into your workflow with GitHub Advanced Security and AI
49mProtect Your Code with GitHub Security Features
56mHow to use GitHub Actions with Security in mind
17mNo More Walled Gardens: Removing Barriers with SCM...
01h 00mLearn Live: GitHub administration for GitHub Advanced Security
38mFortifying Your Codebase with GitHub
27mBuilding a Secure Open Source Project on GitHub