Microsoft GitHub Advanced Security

A leaked credential is a breach waiting to be used. You enable secret scanning, turn on push protection so secrets are caught before they land, and use validity checks to know which leaks are live.

• How secret scanning finds credentials
• Enabling Secret Protection across repositories
• Push protection and what a developer sees
• Validity checks on detected secrets
• Bypass requests and delegated bypass

You build A repository with push protection on, demonstrated by a blocked push and a reviewed bypass request.

Built-in detection does not know your internal tokens. You write custom patterns, test them before they go live, and follow a response routine that revokes the secret first and cleans up afterward.

• Writing custom patterns with regular expressions
• Testing a pattern with a dry run
• Triaging secret alerts
• Revoking and rotating exposed secrets
• Removing secrets from history
• Handling false positives

You build A custom secret pattern tested by dry run, with a written response routine for its alerts.

You cannot assess risk in what you cannot list. You see how GitHub builds a dependency graph from manifests and lock files, read it for direct and transitive dependencies, and export a software bill of materials.

• Manifests, lock files and the dependency graph
• Direct and transitive dependencies
• Submitting dependency data from builds
• Exporting an SBOM
• Reading the graph for an organization

You build A dependency graph review for a sample repository, with its SBOM exported.

Most code is other people’s code. You respond to Dependabot alerts, configure security and version updates, and use Dependency Review to stop a risky dependency before it is merged.

• Understanding a Dependabot alert
• Security updates and version updates
• Configuring updates with the dependabot file
• Dependency Review in pull requests
• Handling alerts with no fix available
• Grouping and scheduling updates to reduce noise

You build A repository configured for security and version updates, with Dependency Review blocking a vulnerable package.

Static analysis finds flaws that tests do not. You choose between default and advanced CodeQL setup, configure workflows and query suites, and bring in third-party scanners through SARIF.

• How CodeQL analyzes code as data
• Default and advanced setup compared
• Query suites and what they cover
• Scanning in a build workflow
• Uploading third-party results as SARIF
• Scanning monorepos and compiled languages

You build A CodeQL workflow configured for a sample app, plus a third-party scanner’s results uploaded as SARIF.

A long list of alerts is not a plan. You read dataflow paths to judge whether an alert is real, use autofix to propose repairs, and manage the alert lifecycle from open to fixed or dismissed.

• Reading an alert and its dataflow path
• Severity and precision
• Autofix suggestions and checking them
• Dismissing with a reason
• Alerts in pull requests and required checks

You build A triage record for a batch of code scanning alerts, with fixes, dismissals and reasons.

With thousands of alerts, order matters. You rank by severity, exploit likelihood and exposure, use CVE and CWE data, and run campaigns that clear a class of problem across many repositories.

• CVE and CWE identifiers
• Severity and exploit likelihood with EPSS
• Security campaigns for large-scale remediation
• Measuring remediation across an organization
• Making shift-left work for developers

You build A prioritization scheme and a campaign plan for clearing one vulnerability class across many repositories.

Defaults rarely fit every organization. You tailor detection with custom queries and patterns, and set the roles and bypass rules that decide who may change or override security controls.

• Custom CodeQL queries and query packs
• Custom secret patterns at organization level
• Roles and permissions for security work
• Delegated bypass and its audit trail
• Reviewing exceptions on a schedule

You build A customized detection set with a governance rule for who may bypass or dismiss alerts.

Security that depends on each team opting in will have gaps. You roll features out with defaults, policies and rulesets, and automate the work of enabling and checking them.

• Enabling features at organization and enterprise level
• Security defaults for new repositories
• Rulesets that enforce checks
• Automating CodeQL setup
• Reporting on coverage and gaps

You build A rollout plan that enables the security suites across an enterprise, with coverage reporting.

One organization joins the course. You assess its repositories, enable secret, supply chain and code protections, set priorities and governance, and present the program and its first results.

• Assessing the organization’s starting position
• Enabling protections in order of value
• Setting triage, priorities and ownership
• Governing exceptions and access
• Reporting results to leadership

You build A security program for a sample organization, with enabled controls, priorities and a coverage report.