GitHub Advanced Security

You can override the default behavior in your repository settings, by specifying the level of severities and security severities that will cause a pull request check failure.

Customizing your advanced setup for code scanning
You can customize how your advanced setup scans the code in your project for vulnerabilities and errors.

Who can use this feature?
Users with write access if advanced setup is already enabled

Example:
Defining the alert severities that cause a check failure for a pull request You can use rulesets to prevent pull requests from being merged when one of the following conditions is met:

A required tool found a code scanning alert of a severity that is defined in a ruleset.

A required code scanning tool's analysis is still in progress.

A required code scanning tool is not configured for the repository.

By default, CodeQL scans on push and pull_request events to identify vulnerabilities introduced in commits or PRs.

If you already enabled CodeQL with the default settings, select the menu labeled "...", then select Switch to advanced. Select Disable CodeQL when prompted. Don't worry, we will re-enable it after we've completed the advanced setup process.

After selecting or switching to advanced, you'll be taken to a GitHub Actions workflow file named codeql.yml. You can find it in your Web Goat repository's /.github/workflows directory. This is the file we use to run and configure CodeQL.

Dismissed alerts can resurface if the same vulnerability is reintroduced in later commits.

Viewing and filtering alerts from secret scanning

Who can use this feature?
Repository owners, organization owners, security managers, and users with the admin role

Note: About the secret scanning alerts page When you enable secret scanning for a repository or push commits to a repository with secret scanning enabled, GitHub scans the contents for secrets that match patterns defined by service providers.

When secret scanning detects a secret, GitHub generates an alert. GitHub displays an alert in the Security tab of the repository.

https://docs.github.com/en/code-security/secret-scanning/managing-alerts-from-secret-
alerts

When a supported secret is leaked, GitHub generates a secret scanning alert. Alerts are reported on the Security tab of repositories on GitHub, where you can view, evaluate, and resolve them.

Configuring automated code scanning integrated into a CI/CD pipeline is the best method to ensure new code is scanned for vulnerabilities because it identifies weaknesses early in the development lifecycle, preventing them from reaching production. This approach provides continuous, hands-off scanning as code is committed or merged, offering immediate feedback to developers and reducing the cost of fixing issues.

https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning

A dependency graph for a private repository on platforms like GitHub is generated or updated when a new dependency is added to its manifest file and this change is pushed to the repository's default branch, How it Works:
1. Manifest File Update: You add a new dependency to a manifest file (e.g., package.json for npm).

2. Push to Default Branch: You then push the changes to your repository's default branch.

3. Automated Parsing: The platform automatically scans the manifest and lock files in the repository.

4. Graph Generation: It uses this information to construct the dependency graph, which shows direct and transitive dependencies, their versions, and any known vulnerabilities.

https://docs.github.com/code-security/supply-chain-security/understanding-your-software-supply-chain/
about-the-dependency-graph

Deleted lines of code containing secrets in a GitHub repository can still be accessed through the dependency graph and other tools, even after deletion. The dependency graph analyzes package manifest files to identify dependencies, including those in deleted or private repositories. Anyone with access to the dependency graph can potentially view the list of dependencies and their transitive dependencies, potentially exposing leaked secrets if they were previously part of the codebase.

If your workflow uses the language matrix, then CodeQL will only analyze the languages in the matrix.

Note:
The default CodeQL analysis workflow file created after configuring advanced setup for code scanning with CodeQL defines a matrix containing a property named language which lists the languages in your repository that will be analyzed. This matrix has been automatically pre-populated with supported languages detected in your repository. Using the language matrix allows CodeQL to run each language analysis in parallel and to customize analysis for each language. In an individual analysis, the name of the language from the matrix is provided to the init action as the argument for the languages input. We recommend that all workflows adopt this configuration.

Incorrect:
[Not A]
Using the language matrix allows CodeQL to run each language analysis in parallel.

https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/
customizing-your-advanced-setup-for-code-scanning