Protect your code with GitHub security features
summary
Repository-level instructions include commit signing enforced via GPG and a beta vigilant mode that flags unsigned or mismatched authors, plus branch protection to require signed commits. GitHub runs Dependabot alerts that open PRs to bump vulnerable versions (example: automatic PRs from 1.2.5 to 1.2.6) and now signs those commits; dependency scans surface transitive flaws (minimist affects ~14M repos). Public repos get secret scanning by default with partner-driven revocation of exposed tokens, and CodeQL builds a code graph DB, runs open queries, and emits SARIF alerts.
AI-written summary · about
chapters (11)
- 0:00Start
- 3:04Why? Attack vectors!
- 3:34Who can push code?
- 5:06How do you push code?
- 6:20What's so bad?
- 7:37Always configure commit signing
- 11:56Vigilant mode
- 17:04Dependabot config
- 34:59DEMO: Security alerts on dependencies
- 35:48Secret scanning
- 44:45CodeQL - What is it?
related talks
49mProtect Your Code with GitHub Security Features
01h 02mDeveloping secure software with GitHub
38mFortifying Your Codebase with GitHub
41mBake Security into your workflow with GitHub Advanced Security and AI
27mBuilding a Secure Open Source Project on GitHub
30mSecuring the software supply chain together
48mAdvanced Security with GitHub without GitHub Advanced Security
39mA Guide to Securing GitHub Based on Lessons Learned