This directory houses information about Git security.
[See Best practices sensitive files to keep secure of https://trello.com/c/GYruL063/167-familiarize-about-sensitive-files-to-keep-off-of-github-and-personal-dashboard#comment-65e76548e1ceb9b9ea814269]
Security options through GitHub
In light of what is posted here there is currently no benefit of me using this feature. My repos are too small - no one else uses them.
Default: Disabled
Mandatory: Enabled
- Dependabot alerts — Displayed notification on the Security tab for the repository, and in the repository's dependency graph. The alert includes a link to the affected file in the project, and information about a fixed version.
- Dependabot updates:
- Dependabot security updates—Triggered updates to upgrade your dependencies to a secure version when an alert is triggered.
- Dependabot version updates—Scheduled updates to keep your dependencies up to date with the latest version.
-
Documentation
- Dependabot performs a scan to detect insecure dependencies and sends Dependabot alerts when:
- A new advisory is added to the GitHub Advisory Database.
- The dependency graph for the repository changes.
- Dependabot alerts are displayed on the Security tab for the repository and in the repository's dependency graph. The alert includes a link to the affected file in the project, and information about a fixed version.
NOTE - Dependabot alert rules can be modified and enabled/disabled.
Default: Enabled with 1 rule
- Dependabot security updates:
- Triggered by a Dependabot alert
- Update dependencies to the minimum version that resolves a known vulnerability
- Supported for ecosystems the dependency graph supports
- Does not require a configuration file, but you can use one to override the default behavior
- Dependabot version updates:
- Requires a configuration file
- Run on a schedule you configure
- Update dependencies to the latest version that matches the configuration
- Supported for a different group of ecosystems
Default: Enabled
Default: Disabled
About version updates for dependencies
You enable Dependabot version updates by checking a dependabot.yml configuration file in to ...
- There can be a
dependabot.ymlfile that is used to configure dependency version updates.
The dependabot.yml file needs to go in the ./.github/ directory.
See https://github.com/JamieBort/Personal-Dashboard/tree/master/.github/dependabot.yml as an example.
Maybe the dependabot.yml file needs to be in the master/main branch before it will work.
Default: Disabled
Automatically detect common vulnerabilities and coding errors.
Identify vulnerabilities and errors with CodeQL for eligible repositories.
Receive alerts on GitHub for detected secrets, keys, or other tokens.
Default: Disabled
NOTE - Not visible until Secret Scanning is enabled.
Default: Disabled
-
https://trello.com/c/LD9EOfZ1/268-enable-github-code-scanning-across-all-of-my-repos
-
Establish Security Measures #35
-
Using secrets in GitHub Actions
Secrets allow you to store sensitive information in your organization, repository, or repository environments.
-
How to keep your repository’s sensitive data secure using git-secret May 13, 2018 Medium article by Georgios Goniotakis.
(Also saved in Resources section of the README file in the Security/ directory.)
-
Software Security workshop by jbelmont.
(Also saved in Resources section of the README file in the Security/ directory.)
- About secret scanning
GitHub scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally.
This readme file.