Building a Secure Open Source Project on GitHub
Talkat Open Source in Finance Forum New York 2022 · on Thursday, 2022-12-08· at 14:35· HUB 2, New York, NY, USA·
summary
Shows concrete steps: enable Dependabot to open PRs that bump to the lowest secure version (users patch 13 days faster), run CodeQL code scanning in GitHub Actions so 74% of findings are fixed in the pull request, and publish draft security advisories that create temporary private vulnerability repositories to collaborate on fixes before disclosure and request CVEs from GitHub. Also configures contributing.md, issue templates, CodeSpaces dev environments, and uses the dependency graph and 2,000 free Action minutes to automate checks.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:46Securing Dependencies
- 7:02Code Scanning
- 12:30Code Scanning Improvements
- 13:15Security Policy
- 19:34Friendly projects
- 19:59How to contribute
- 20:19ContributingMD document
- 21:16Issue and pull request templates
- 21:53Repository settings
- 22:08Good first issues
- 22:57Quick changes
- 23:30GitHub Code Spaces
- 24:36GitHub Actions
related talks
38mFortifying Your Codebase with GitHub
30mSecuring the software supply chain together
41mBake Security into your workflow with GitHub Advanced Security and AI
49mProtect Your Code with GitHub Security Features
01h 02mDeveloping secure software with GitHub
58mProtect your code with GitHub security features
21mOpen source security: advisories and workflows to keep open source secure
25mSecure Your Open-Source Project with GitHub