Security Scanning

Free, automated, no excuse not to run

GitHub provides several first-party scanners that integrate directly with the PR review UI. None of them require new infrastructure. All of them surface findings alongside code review. Turn them on.

CodeQL — SAST (Static Application Security Testing)

Maintained by GitHub.
Detects classic vulnerability patterns: SQL injection, XSS, path traversal, deserialization issues.
Free for public repos; included in GitHub Advanced Security for private.
Setup: a single workflow file with github/codeql-action.

Secret Scanning

Built into GitHub. Zero workflow needed.
Detects 200+ token formats: AWS, GCP, Stripe, OpenAI, Anthropic, GitHub PATs.
Push protection blocks the commit at git push time if a secret is detected.

Dependency Scanning

Dependabot alerts on known-vulnerable dependencies.
Dependabot version updates auto-PR new versions.
Enable both in repo Settings → Code security.

Third-party scanners worth adding

trivy — container image and IaC scanning.
gitleaks — additional secret patterns.
semgrep — custom rules for application-specific patterns.

Code

CodeQL — minimal workflow·yaml

name: codeql
on:
  push: { branches: [main] }
  pull_request: {}
  schedule:
    - cron: '0 6 * * 1'   # weekly Monday

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    strategy:
      matrix:
        language: [python, javascript]
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with: { languages: '${{ matrix.language }}' }
      - uses: github/codeql-action/analyze@v3

Free, automated, no excuse not to run

CodeQL — SAST (Static Application Security Testing)

Secret Scanning

Dependency Scanning

Third-party scanners worth adding

Code

External links

Exercise

Progress

Comments 0