Getting started with GitHub security | GitHub for Beginners

Today, I'm going to teach you everything you need to know to get started with GitHub security. [music] By the end of this video, you'll understand how to fix a security vulnerability in your GitHub repository using built-in tools like Secret Scanning, Dependabot, [music] Code Scanning, and Copilot Autofix. Hey, I'm Cadia and I'm so excited [music] you're here with me today. Let's talk about why security matters and how you can keep your repos secure using GitHub tools. Security matters because vulnerabilities are weaknesses in your code or the libraries you use that attackers can exploit. Even if you didn't write the vulnerable code yourself, you can still inherit the risk the moment you import that library into your project. That's why even small or brand new projects can have vulnerabilities. Almost all software relies on third party packages. GitHub makes finding and fixing these issues easier than ever with GitHub advanced security. I'm bringing in my friend Aried to tell us more about GitHub advanced security and how you can keep your repo secure. GitHub advanced security is a suite of products that helps you improve and maintain the quality of your code. On public repositories, you have access to tools like dependabot code scanning, secret scanning, and copilot autofix. First, let's make sure GitHub advanced security features are turned on. In your repo, go to settings, advanced security, enable dependabot alerts and security updates. Scroll down to code scanning. Enable codeql analysis with the default setup. And finally, enable secret protection. Public repos get these by default. Private repositories will need a gas license. Now, let's head to the security tab where we can see alerts for exposed secrets, vulnerable dependencies, and risky code paths. GitHub can help you protect sensitive information with secret scanning. If you accidentally commit an API key or token, secret scanning will flag it right here in the security tab. Click the alert title to see what secret was detected and where it was found. GitHub can't revoke the secret for you. Revoking a secret just means disabling the old key so it can't be used anymore. Usually by generating a new one on the platform where the secret came from, like Azure or Stripe. You'll need to do that part yourself, but secret scanning gives you an early warning so a leak secret doesn't become an exploited one. Once you've revoked the secret, you can close a secret scanning alert by clicking closed as revoked. Dependabot is a code scanning tool that helps you keep your dependencies up to date and a dependabot alert informs you of these vulnerabilities. With a Dependabot alert, you'll see that Dependabot found a vulnerable library and opened a pull request to update it. You can scroll down on the alert page to view the specific GitHub security advisory that triggered the alert. Let's open the PR, review the version bump, and if everything looks good, merge the PR. DependentBot automates turning GitHub security advisories for dependencies into pull requests, so you don't have to track common vulnerabilities and exposures manually. Looks good to me. Let's merge. Learn more about GitHub advanced security by going to GitHub skills and completing the vulnerable node challenge. It's a fun and interactive way to learn about security. You can also read the blog post that accompanies this episode at gh.io/gfbcurity. Now, let's look at a CodeQL alert. This alert says, "User input may reach a dangerous function." CodeQL isn't a llinter. It's much more powerful. It understands data flow, showing where input starts and where it ends up. Let's read the rule help text to understand this vulnerability, its risks, and see some sample fixes. Now that we have a better understanding of the alert, let's use Copilot autofix to resolve it. Click generate fix on the alert. Copilot will suggest a patch like validating input or parameterizing a command. Review the change and click commit to new branch. Select open a pull request and then open pull request on the modal so we can review the code before merging it to our default branch. Remember, Copilot accelerates security fixes, but you stay in control. Checks are green, so let's merge and the alerts disappear from the security tab. Thanks so much, Ari, for showing us how to use GitHub advanced security to detect and fix vulnerabilities confidently. Remember to check out the vulnerable node repo to learn [music] security practices in a fun and engaging way. I hope you found this video helpful. [music] Remember to subscribe to GitHub's YouTube channel so you don't miss any of our future uploads and share with a dev friend who could use this knowledge. Happy coding.