You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Ensuring code security is imperative in today's environment. When we think about how we create code today, there's three main areas to focus on:
4
7
5
8
- The code we write
6
9
- The code we use through libraries and packages
7
10
- The credentials needed to access services
8
11
9
-
To help support developers and security teams, [GitHub Advanced Security](https://github.com/features/security) provides a suite of tools which cover these focus areas. Code Scanning will check the code you write, Dependabot ensures the libraries you use are secure, and Secret Scanning looks for any keys or tokens which are checked into code.
12
+
To help support developers and security teams, [GitHub Advanced Security][advanced-security] provides a suite of tools which cover these focus areas. Code Scanning will check the code you write, Dependabot ensures the libraries you use are secure, and Secret Scanning looks for any keys or tokens which are checked into code.
10
13
11
14
Let's explore each of these, and enable them on our repository. We'll see them in action when we create a pull request with new code later in the workshop.
12
15
@@ -16,7 +19,7 @@ Security is important in every application. By detecting potential vulnerabiliti
16
19
17
20
## Dependabot
18
21
19
-
Most projects take dependencies on open source and other external libraries. While modern development would seemingly be impossible without these resources, we always need to ensure the dependencies we take are secure. [Dependabot](https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide) will look at the dependencies your repository has and raise alerts or even create [pull requests](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests) (PRs) to update your dependencies to a secure version.
22
+
Most projects take dependencies on open source and other external libraries. While modern development would seemingly be impossible without these resources, we always need to ensure the dependencies we take are secure. [Dependabot][dependabot-quickstart] will look at the dependencies your repository has and raise alerts or even create [pull requests][about-prs] (PRs) to update your dependencies to a secure version.
20
23
21
24
### Configuring Dependabot
22
25
@@ -80,10 +83,22 @@ A background process starts, and will configure a workflow for analyzing your co
80
83
81
84
## Summary and next steps
82
85
83
-
In this exercise, you enabled GitHub Advanced Security. You enabled Dependabot to check the libraries your project takes dependencies on, secret scanning to look for keys and tokens, and code scanning to examine your source code. These tools help ensure your application is secure. Next it's time to [file an issue](2-issues.md) to add feature requests.
86
+
In this exercise, you enabled GitHub Advanced Security. You enabled Dependabot to check the libraries your project takes dependencies on, secret scanning to look for keys and tokens, and code scanning to examine your source code. These tools help ensure your application is secure. Next it's time to [file an issue][walkthrough-next] to add feature requests.
0 commit comments