Flipping the Script on Application Security
summary
GitHub finds a linear rise in security threats as lines of code grow, with a 40% increase in dependency alerts from 2019–2020 and about a 60% year‑over‑year rise in leaked tokens into public repos; web app attacks remain the top breach cause. Security teams are vastly outnumbered (roughly 570:1 globally, ~100:1 in enterprises), under 10% run SAST weekly, 38% report no SAST, and only 5% of developers trust automated SAST results. Product fixes include dependabot halves fix time by opening PRs, CodeQL semantic queries with community contributions, and push protections block secrets before they land.
AI-written summary · about
chapters (11)
- 0:00Start
- 10:33Security teams are outnumbered
- 11:53Securing first party software is just the start
- 12:43Security isn't part of the developer workflow
- 13:37Poll: How Integrated are you SAST practices?
- 26:15Credential scanning is a perfect candidate to shift left
- 29:25What if we design around the developer experience?
- 33:13Static analysis should be automated security review
- 36:09Code Scanning
- 39:04Secret scanning for private repositories
- 41:04Vulnerability exposure analysis
related talks
19mFlipping the script on application security
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
45mShifting from Syntax to Secure Software Development Processes
38mAppSec is Dead Long Live DevSecOps!
50mThe Application Security State of the Union
32mCode Security Reinvented: Navigating the Era of AI
49mFrom Application Security to Developer Security