From the course: GitHub Advanced Security Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 24,700 courses taught by industry experts.

Advanced security alert and list potential remediation

Advanced security alert and list potential remediation - GitHub Tutorial

From the course: GitHub Advanced Security Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Advanced security alert and list potential remediation

“

- [Instructor] Well, again, we're talking top-level themes here. On the security tab in your repository, we've seen we're looking to three remediation strategies, Dependabot, which helps us keep our dependencies safe and current, secret scanning, which allows us to see and quickly revoke any accidentally exposed secrets in our code base, and then of course CodeQL and code scanning that allows us to refactor vulnerable code. So the best practice, number one, make sure you're using GHAS and you've got it configured. You've got scanning happening to the degree that you need. And I've taught you how to use configuration files for those three GHAS services so you know how to configure them so they're not doing too much work and you're spending extra money but they're also doing not enough work and you're resolving false positives. So a lot of plates to spin for sure. We've seen several times the degree and robustness of the GitHub notification system, which as always you can get to in your…

Contents