GitHub Advanced Security for Developers

Overview

This repository contains the courseware for the GitHub Advanced Security for Developers course. The course is designed to help developers understand how to secure their code using GitHub Advanced Security.

Schedule

• Session is approximately 3 hours
• One 15 minute break about halfway through
• First 2 hours are lecture and demos
• Last hour is Q&A
• There are no independent labs, but the demos are scripted so you can follow along or explore them on your own following the session

Outline Overview

• What is GitHub Advanced Security (GHAS)?
• Survey of GitHub.com for GHAS features
• Secret Scanning
• CodeQL
• Dependabot
• Security Policies
• Branch Policies
• Q&A

Course Documents

• Course Outline
• Course Slides
• Slides Notes
• Glossary

Demos

• 01 - Non-Provider Secret Scanning
• 02 - Custom Pattern Secret Scanning
• 03 - Remove Secret from Repo
• 04 - CodeQL Default Setup
• 05 - CodeQL Advanced Setup
• 06 - CodeQL Manual Trigger
• 07 - Integrate with Third-Party Scanner
• 08 - Dependabot Default
• 09 - Dependabot Custom
• 10 - Security Policy

Repos for Demos

• Tools App Svelte Website
• C++ Buffer Overflow
• Flask App
• Swiss Cheese

Resources

• GHAS
• Actions
• Administration
• GitHub Advanced Security solutions
• Code Security and Scanning
• Secret Scanning