►
From YouTube: GitHub Планета
Description
5:56 - Start
Приглашаем вас на апрельскую виртуальную встречу ГитХаба на тему безопасности !
Наша встреча пройдет во вторник, 20 апреля, с 19:00 до 20:00 по Московскому времени. Наши ведущие Хабберы расскажут о новинках ГитХаба.
14:33 - Артём Савельев (разработчик в GitHub:SecretScanning) расскажет о превентивной безопасности в цикле разработки.
42:45 - Алена Глобина (Продакт Менеджер в GitHub:Code scanning CodeQL) расскажет про Анализ безопасности кода с помощью CodeQL.
В конце презентации наши ведущие и докладчики присоединятся к дискуссии в комментариях к YouTube каналу. У вас будет возможность познакомиться c ними, задать им вопросы, обсудить общие интересы русскоговорящего сообщества разработчиков и может быть выиграть подарки от ГитХаба.
A
A
A
A
It
seems
like
small
things,
but
it
saves
a
lot
of
time
help
a
lot,
especially
when
it
gets
used.
You
don't
understand
how
already
or
before,
for
example,
we
added
support
for
the
markdown
table
of
contents.
File
no
longer
need
to
make
a
huge
table
of
contents
list
at
the
beginning
of
the
big
rhythm.
You
just
have
a
combobox.
This
go
where
you
need
it.
We
added
support
for
hyperlink
with
relative
paths.
A
Now
you
can
copy
only
on
one
side
of
the
comparison
of
the
change
of
the
split
mode
of
the
cut
of
the
rags
and
the
comparison
of
the
comments
of
different
before
now
supports
splitting
into
with
page.
Where
for
this,
if
you
have
a
very
big
difference,
250
comments
is
a
duck
duck.
Those
dark
darkened
themes
now,
jenner,
you
loved
those
and
in
git
hop
com,
their
guide,
hat
enterprise,
claudia
and
we
added
a
new
look
from
the
theme
for
leya
skoda.
A
Code
blocks
now,
code
tagging
supported
also
in
headers
and
went
pr
and,
of
course,
in
their
mentions,
new
joke
for
inserting
code
blocks.
Markdown
files
cindy
and
for
macs
control
is
ideal
mobile.
We
have
added
deployment
review
in
git
cottage
captive
and
now
you
can
allow
or
deny
__
]
that
are
waiting
for
your
review
to
see
the
deployment
status
themselves
deployed
from
the
triad
to
receive
push
notification
that
your
view
is
needed
and
everything
that
needs
your
permission
will
be
visible
in
the
notification.
A
Then
we
added
the
configuration
of
the
type
of
notification
on
the
phone
exactly
the
same
as
the
moves.
If
you
receive
too
many
notifications,
you
can
customize
and
receive
only
what
you
really
your
also
added
new
pu
sh
notifications,
requests
for
review
bubbles,
quests
and
deployment
when
I'm
not
looking
for
a
pull
request
of,
and
for
me
there
is
no
schedule
on
kitkat
phones.
A
Desktop
now
supports
where
the
skull
is
using
dragon
drop
or
menu,
it
can
be
canceled,
can
conflicts
be
resolved
using
access
and
how
discussions
red
fox
went
into
beta
the
more
around
7,
more
possibilities
to
write
action,
ebs
code
that
will
help
you
in
your
work,
backup
container
against
you.
There
is
a
possibility
of
internal
visibility
with
you
work
in
a
large
organization.
You
can
use
this
to
redon
whether
I
have
access
to
your
love,
edema
and
kill
everyone,
but
also
the
topic
of
today's
security
meeting.
A
The
biggest
important
phisher
that
I
think
was
released
this
month
is
a
general
overview
of
the
security
risk.
What
give
up
advance
security
in
the
show
and
in
which
repositories
it
is
not
set
at
the
group
organization
level.
You
have
one
dashboard,
you
you
see,
everything,
I'm
sure
that
Artyom
will
tell
you
about
this
in
much
more
detail
very
soon,
ro
scanning
secrets
to
provide
easy
thorium
of
came
out
general.
You
loved
qi
warning
from
all
scanning
products
to
summarized
in
one
review
on.
A
Of
course,
I
would
like
you
to
use
masonry
and
Alena
today
will
tell
you
why
you
can
use
not
our
product
and
not
one
product
and
you
you
will
see
it
in
one
review.
No
cottages
will
now
be
able
to
automatically
require
certificates
for
co
domains
if
you
really
built
big
ones
with
le
pins.
Yes,
here
is
the
warning
de
piedra
bot
of
publishing
new
versions
of
the
dependency
came
out
general.
His
favorite
before
first
of
all
this
year
was
added
to
search
security
war,
shy
price.
A
If,
for
example,
a
neighboring
group
is
responsible
for
the
code
you
are
using,
you
want
to
know
that
they
have
a
new
version,
great
way
to
find
out
about
it
and
grouping
olya.
So
you
work
if
they
were
discovered
at
the
same
time.
It
also
helps
if
a
liar
so
many
hope
you
don't
well,
maybe
better
get
less
spam,
get
it
together,
see
fix
and
defecation.
A
If
you
want
to
read
more
from
there,
there
are
links,
and
in
general
please
go
to
our
blog
to
our
blog
and
not
everything
that
we
even
released
in
a
month
and
all
the
time
there
are
new
items
and
besides
we
have
a
security
block
and
as
you
know,,
the
vast
majority
of
security
incidents
are
not
due
to
the
fact
that
some
hacker
did
something
from
the
mistakes
of
our
mistakes
of
our
users,
and
it
is
very
important
to
read
and
correct.
There
may
be
small
things
that
will
then
prevent
big
problems,.
A
For
example,
3
posts
lately
on
our
security
are
good,
which
were
really
interesting
and
I
wanted
to
say
some
things
to
which
are
translated
into
Russian.
Simple
is
more
important
from
my
point
of
view,
and
if,
from
your
point
of
view,
too,,
then
you
can
go
read,
for
example,.
It
is
very
important
that
from
August
13
it
will
require
the
defecation
of
ninjas
flows
to
misfire,
whether
the
miracle
of
all
operations
will
not
bring
down
the
user
and
password,
but
30
June
and
28
June,
30
and
July
28.
A
A
A
A
very
good
post
recently
came
out
about
best
practices,
managing
secrets
based
on
the
principle
of
least
privilege,
talks
about
how
to
arrange
secrets
which
book
accessibility,
how
to
restrict
usage,
how
to
set
up
a
sorcerer,
how
to
create
rules
for
well
protection
as
integration
with
the
repository
of
rotation
secrets
is
best
again
e.
We
have
a
post
on
habré
and
a
wonderful
translation
with
an
advertisement
of
our
meetup,
too,.
Maybe
you
have
already
seen
a
very
good
translation
read
if
you
use
kitkat
action,
it
is
very
useful.
A
Last
February
alex
bersin
do
security
research
published
I
don’t
know
if
you
saw
it
or
not
come
stand,
hood
different
languages.
If
you
h,
ve,
correct
libraries
g
tracks
that
it
in
your
repository
will
go
through
the
repository,,
then
here
is
a
chance.
If
you
have
a
wrong
configuration
that
f
hackers
put
public
repositories
with
the
same
names,
public
regis,
ry,.
B
A
Code
may
not
work
corre
tly
husband
get
one
of
what
ou
expected
and
o
eg
security.
Research
in
a
real
hackers
can
come
the
main
languages
he
tested
were
java-
cript
we
ar.
Therefore
we
have
a
block
again
but
langu
ges
in
the
morning
body
dear
please
use
bracket
for
internals
j.
Take
this
l
pe
to
public
xmas
ntn
and
the
no
one
will
be
able
to
publish
nothing
use
in
1
russian
file
in
hand
n
project.
Follow
the
design
react
quickly
to
errors.
A
Python
answer:
I
did
not
find
everything
that
they
write
just
go
and
you
have
problems
with
the
configuration
then
make
the
same
bikech
on
soldered
and
ruby
answered
that
the
w
tank
will
oon
be
subordinated
to
the
banner
really
eat.
I
do
the
configuration
and
install
this
one
as
we
breathe
and
then
you
can
sleep
peacefully,
and
this
is
just
what
I
urge,
please
go
to
our
blog
on
our
engineer.
A
C
Everyone
thanks
back
I
will
talk
about
security
safely
with
development,
with
the
help
of
which
they
provide
no
x,
but
I
usually
mean
this
metal.
My
name
is
artem
saveliev
and
at
the
same
time
I
am
an
engineer.
Product
is
safe
in
gifs,
so
today
I
act
as
a
presentation
to
tell
them
about
what
I
personally
work
about
and
what
we
have
done
lately.
Food
over
the
past
year
has
been
working
on
the
functions
of
the
face:
simulator
secrets
and
security
europe.
C
So
today,
I
will
tell
you
about
all
our
products
that
are
which
we
present
to
ensure
security.
Well,
I
don’t
want
to
be
obvious,
but
secure
in
2021.
You
almost
always
should
start
with
lari
gay.
Then
it
was
hacking
at
the
expense
of
systems
with
the
help
of
an
attack
we
paid
for
happened
recently.
The
wallet
was
inserted
into
a
legitimate
library
by
tomboys
or
lovers
of
laurence
products
inserted
back
door,
which
was
then
the
system
around
the
world
and
because
it
is
from
the
libraries
of
which
it
was
added
to
their
product.
C
C
C
C
Vulnerabilities
at
a
fairly
constant
rate,,
this
does
not
mean
that
you
are
a
bad
developer,.
It
just
shows
that
creating
secure
programs
is
quite
difficult.
If
you
think
about
it,,
then,
in
order
to
create
absolutely
safe
and
application,
you
must
always
be
right.
You
should
never
make
mistakes
and
to
add
a
command.
It
is
quite
possible
to
make
a
mistake.
C
We
have
evidence
that
the
teams
that
use
the
method
and
the
dc
hub
are
reduced,
saves
time
and
that
they
need
to
make
sure
that
the
survival
rate
is
not
sore,,
in
particular,
the
teams
that
do
security
scans
as
part
of
the
daily
development
process
and
they
find
and
fix
vulnerabilities
faster,
and
if
we
proceed
from
the
assumption
that
we
add
everything
we
will
someday
add
a
vulnerability
like
I
said:
it’s
very
difficult,
not
to
always
write
a
safe
move,.
Otherwise
this
metric
has
become
practically
the
most
important
lately
before
fixing.
C
Since
the
atom
will
increase
the
speed
of
finding
the
country
of
vulnerability,
we're
shifting
all
our
security
practices,
our
processes
to
the
left,
what
does
that
mean?
Looking
at
a
typical
development
process
for
a
feature
or
entire
product
for
a
development
team
start
with
design
planning,
then
write
code
test?
And
then,
if
you
have
a
team
security
team,
but
it
comes
and
analyzes
your
code,,
and
this
happens
before
launch
after
the
cat
is
already
built
and
it’s
hard
enough
to
make
changes
at
this
moment,
and
because
of
this,,
because
it’s
hard
to
make
a
change.
C
,,
the
most
serious
problems
are
usually
solved
at
this
moment,,
and
this
leads
to
because
the
vulnerabilities
are
after
your
functionality
or
your
application
is
already
running
or
deployed,
and
now
you
are
in
a
mode
together,
you
will
need
expensive
work
to
go
back
and
fix
them.
Not
everything
comes
naturally
through
the
development
of
something
new
and
so
dare.
If
we
will
move
to
the
left
and
first,
we
need
to
provide
the
development
teams
with
the
tools
to
help
and
declare
problems.
C
Safe,
runs
as
early
as
possible
in
the
early
stages
of
development
of
the
wild.
We
are
focusing
on
creating
a
tool
goes
to
herd,
to
enable
developers
to
detect
the
problem
as
early
as
possible,
and
today
I
will
talk
about
how
you
can
use
them.
Secondly,
carry
over
the
security
review
process
from
already
completed
code
or
from
the
moment
of
testing.
You
move
it
to
much
earlier
process
much
earlier
stages
of
the
process.
C
It
requires
a
lot
less
frames
of
views
and
encourages
cooperation
with
this
people
of
this
team,
in
contrast
to
the
more
traditional
model
where
security
is
just
an
obstacle
for
developers
to
overcome
and
eliminate
in
order
to
launch
the
production
functionality
to
finish
posted
the
video,
the
person
responsible
for
security
comes
after
your
function.
Kovalev,
your
position
is
already
running,
and
then
they
come
and
demand
to
change
it.
So
it
is
better
to
use
the
security
consultation
model
and
talk
time.
C
Safe
talk
should
start
earlier,
so
this
model
gives
developers
the
ability
to
just
work
and
talk
about
security
much
earlier
and
insists
they
have
a
productive
relationship.
Instead
of
arguing
over
what
changes
in
tools
and
methods
mean,
you
have
a
much
better
chance
of
discovering
security
issues,
early
stages
of
the
life
cycle,
of
creating
your
product,.
Despite
the
fact
that.
C
C
Earlier,
I
have
already
said
that
in
the
wild
we
learned
to
create
tools
that
allow
developers
have
security
issues
as
early
as
possible.
So
let's
talk
a
little
bit
about
these
tools
and
they
are
all
under
the
flexible
umbrella.
Batman
security
is
our
set
of
security
tools
focused
on
developers.
All
of
these
tools
are
designed
to
help
you
write
safer
code
by
identifying
security
issues
in
earlier
development.
Within
the
framework
you
will
gain.
There
are
three
main
features.
C
First,
is
the
secure
dependency
feature
correctly,
then,
to
help
it
understand
which
dependencies
to
use
and
how
you
use
them?
This
is
classic
tools
for
analyzing
the
composition
of
your
product
of
your
project,
but
focused
on
developers
and,
secondly,
secure
code.
This
feature
aims
to
help
you
ensure
that
the
code
that
you
write
and
that
your
team
writes
is
secure
using
static
analysis
and
safe
from
guards
and
secrets.
C
Want
to
make
sure
you
port
and
your
project
dependencies
are
safe
and
safe
to
use
and
I'll
talk
about
a
few
tools
within
our
our
product.
Our
products
for
dependency,
safe
first,
this
is
our
a
friendly
robot
is
called
for
winding.
It
helps
you
update
dependencies
with
the
help
of
a
reminder,
and
it
is
automatically
happy
orifice
when
to
update
dependencies
in
the
second
projects
dependencies
interview
and
it
works
right
inside
the
positivity
and
shows
which
ones
change,
which
ones
are
added
and
information
about
these.
C
C
A
decade
of
baht
can
do
a
few
things
for
you.
Firstly,
it
helps
to
detect
and
fix
dependencies
with
security
vulnerabilities
and
when
a
lot
of
it
is
published
on
the
internet
for
the
version
you
are
using
and
here
reports,
this
most
cases
decades
will
be
able
to
automatically
generate
later,
a
quest
to
update
your
project
with
a
safe
version
of
the
dependencies
you
are
using
and
if
you
can
not
update,
then
for
example,
because
you
directly
specified
the
version
number
without
asterisks.
Then
this
presents
you
with
words
of
warning
and
gives
steps
to
solve.
C
Guys
under
also
can
automatically
update
all
your
dependencies,
not
only
those
that
have
vulnerabilities
and
every
time
a
new
version
of
the
dependency
is
launched.
It
creates
a
project,
and
this
keeps
you
from
living
together,
found
in
older
versions
or
from
the
fact
that
you
are
stuck
in
civilian
clothes,.
You
no
longer
know
how
anal
addiction
is,
because
you
have
accumulated
too
much
old,
addiction,
and
well,.
C
The
main
thing
I
want
to
say
about
this
mod
is
that
in
the
registers
in
which
it
is
included,
on
average,,
they
fix
together.
At
one
point
four
times
faster
than
the
world,
and
almost
no
one,
it
doesn't
use
our
stats,
but
the
waist
check
dependency
is
a
relatively
new
feature
that
was
recently
launched,
told
you
that
capsules
people
it
helps.
You
understand
what
changes
are
made
on
the
level.
Swam
quest,
prove
dependency,
which
you
use.
C
This
is
our
secret
created
which
work
the
previous
functions,
of
which
I
told
this
is
a
dependency
graph.
It
helps
the
decrepit
to
understand
which
packages
you
depend
on,
so
that
we
can
provide
information
on
and
the
dependency
graph
supports,
their
patina
and
ruby
stove
systems,
and
if
your
proje
t
is
written
from
it
on
one
follo
me
in
the
language
of
the
fan,,
it
is
desirable
to
include
a
secret
about
the
project.
There,.
C
C
Secu
rca
records
is
a
tool
that
will
help
you
detect
potential
security
issues
in
the
new
year
that
were
your
team,
so
others
talk
about
some
features:
secu
rca
records
stone
is
our
functional
user
interface
for
analyzing
and
responding
to
warnings
generated
by
the
static
analysis
tool,
and
it
helps
you
using
browse
information
in
the
tools,
and
this
is
our
thematic
code
analysis
engine,.
It
is
a
guideline
to
help
you
find
vulnerabilities
in
the
code
by
creating
your
team
and
show
them
through
the
interface
with
bones
and
support
for
third-party
analyzers
that
help
you
expand.
C
Static
analysis
tools
too,
and
we
support
the
display
of
assemblies
through
which
are
done
on
actions
as
well
as
third-party
tools
neighbors
on
the
sub.
You
do
not
need
to
move
the
disassembly
stroke.
You
can
use
the
sub
stone
annexation
force,
which
you
set
up
sticking
out.
This
is
our
mathematical
engine
analysis
that
allows
you
to
scan
your
code
for
complex
cartridges
that
indicate
potential
is
based
on
more
than
just
rules
that
are
all
console
and
new
ones
are
added
regularly
labs
safely
and
community
here
is
hell
but
mind.
C
C
Ack
at
the
beginning
of
the
gate
colleague,
I
passed
the
manag
r
a
couple
of
weeks
ago,
publ
an
article
on
the
logic
cup
which
described
in
detail.
The
gallop
can
use
twists,
LA.
and
scan
codes
to
detect
traces
of
the
enforcers
of
this.
Your
infrastructure,
where
the
traces
of
the
remains
of
sara
gate
can
be
used
to
infect
other
systems
of
your
network.
A
group
of
researchers
from
auto
created
several
requests
for
Catskill
to
search
for
traces
of
the
greenhorn,
and
it
makes
our
community
cells
all
and
now
everyone
can
use
them.
C
Big
part
of
what
makes
the
jacket
a
powerful
tool
without
going
through
hell
in
the
end
of
support
for
third-party
tools-
short
Russian,
developed
based
on
the
sev
standard.
So
you
can
use
the
comparison
of
static
analysis
tools
and
we
will
show
the
results
that
these
tools
provide
and
you
can
use
them
view,
along
with
the
results
wanted
by
the
firm
in
our
interface.
C
Are
listed
here
on
the
right
and
some
of
these
istrians
you
can
easily
integrate
with
the
narrow,
did
not
touch.
Let's
talk
about
the
kept
secrets,
as
I
mentioned
before.
Modern
architecture
often
represent
the
scoop,
the
complexity
of
related
service
applications
and
you
use
different
games
and
each
of
these
separate
tools.
Of
course,
data
scientists
for
data
to
integrate
our
functionality,
and
it
is
not
to
accidentally
enter
these
data
scientists
into
your
office
reposition,,
which
can
lead
to
their
internal
and
external
leakage.
C
To
us,
there
are
several
flavors
with
secrets:
none
of
them
aims
to
prevent
secrets
from
being
revealed
to
open
source
move
and
the
other
to
closed
in
mountains
and
sikorsky
and
for
public
repositories
git
hard
scans,
every
comet
in
all
street
repositories,
all
over
github,
it
known
formats
of
secrets
or
leaving
such
as
data
to
enter
in
the
amount
of
amazon
and
google
or
tokens
and
5
for
the
growth
of
public
services,.
We
find
these
currents,,
but
we
notify
the
service
that
issued
these
credentials,.
C
C
D
C
We
certainly
will
not
name
so
I
began
to
inform
a
third-party
service
that
sigma
1
as
we
inform
you
so
that
you
can
already
decide
what
to
do
with
these
secrets.
We
are,
of
course,
wealthy.
We
recommend
to
change
them
and
rotate.
Yes,
this
choice
fell
on
20
nectar
from
partner
companies
that
are
kaskelen.
C
C
C
and
also
the
author
shows
the
risk
based
on
the
number
and
type
of
these
warnings.
If
you
expand
the
graph
at
the
top,
you
can
see
a
breakdown
of
the
risk
by
repositories
and
or
it
shows,
the
security
features
are
enabled
for
different
repositories.
For
example,
in
this
case,
you
can
see
that
the
organization
is
doing
well
with
the
implementation
in
the
list.
They
are
detailed.
Tank
songs
are
included
quite
almost
completely
one
hundred
percent,
but
lagging
strips
and
kowalski
is
not
included
in
many
stories
of
the
other
side.
C
C
The
society
for
your
organization
and,
if
all
of
them
back
you
can
see
the
risk
level
for
each
repository,
the
number
of
warnings
for
each
function
seconds
under
you
can
sort
the
tables
by
whether
it
is
enabled
or
disabled
this
feature
and
the
risk
level.
If
you
work
you
want,
I.e.
the
price
on
the
more
important
repositories
or
count
the
number
of
warnings
from
a
certain
type.
C
If
you
want
it
honestly,
the
arrangement
of
one
of
these
warnings
I
want
to
fix
this
year
and
also
binds
all
your
functions
by
misfortune
is
not
very
our
end.
It
launched.
We
have
been
working
on
for
a
long
time
and
functions
that
once
again
allow
you
to
associate
it
all.
Our
secret
functions
on
the
one
and
the
same,
and
the
last
commit
what
you
can
do
next.
C
If
you
want
to
do
it
for
the
type
of
left
for
safety,
you
need
to
make
sure
that
everyone
has
your
temple
in
action
tools
of
information
to
identify
potential
problems
before
they
become
public.
You
need
to
involve
your
security
game
of
people
who
are
involved
in
security
in
the
early
stages
of
the
development
life
cycle,
to
immediately
develop
secure
functionality
and
our
github
tools.
C
C
B
Russian
hello
today,
I
want
to
tell
you
about
code
security
analysis.
Artyom
has
already
touched
on
this
topic,
but
I
would
like
to
delve
a
little
deeper
into
this
issue.
This
is
a
fairly
new
feature
that
became
available
to
developers
who
use
the
hop
guide
a
little
over
a
year
ago.
Specifically,
this
is
a
cat
scanning.
Otkel
I
will
start
with
a
quick
introduction.
My
name
is
alyona
depth.
B
I
GitHub
product
manager
specifically
working
on
codes,
canin
din
and
spruce
rollers
products
originally
from
Ukraine,
but
for
the
last
five
years,
I
have
been
living
far
away
today.
I
want
to
talk
about
security,,
namely
why
security
is
a
problem
in
today's
world,,
how
this
problem
looks
and
why
we
all
need
it
together,
decide
what
we
generally
call.
We’Ll
talk
about
security
101,
then
I’ll
talk
a
little
about
how
git
hop
sees
a
solution
to
this
problem,
specifically
for
code
security,.
What
Artem
already
talked
about,,
but
we
will
repeat
a
little
here
spoiler.
B
Of
course
we
see
a
solution
to
this
problem
by
popularizing.
The
use
of
tools
such
as
scanning
cat
and
Kotke
further
I
I
will
focus
on
a
very
high
level
overview
of
how
cat
cohen
works
to
analyze
your
code
and,
at
the
end,
we
will
watch
a
short
video
on
how
you
can
enable
scanning
and
code
on
your
repositories.
Let's
start
security
101.
We
have
analyzed
security
statistics
for
the
last
five
or
six
years
and
noticed
that
the
more
code,
the
more
problems
sounds
very
obvious
and
very
banal,.
B
But
it's
true
that
the
number
of
developers
writing
code
is
growing
from
year
to
year,
and
the
number
of
security
experts
is
not,
and,
as
it
was
said
here
before
,,
we
have
statistics
on
which
we
know
that
83
percent
of
apps
have
at
least
one
vulnerability,,
and
that's
everything
tells
us
that
it
is
normal
for
them
to
have
vulnerabilities
in
the
code,.
It
is
difficult
to
write
programs,.
These
are
all
very
large
and
complex
systems,,
and
it
is
not
a
shame
to
create
a
product
that
is
not
ideal
in
terms
of
security,.
B
So
when
we
talk
about
code
security,
I
like
to
look
at
this
problem
from
two
sides,
first
is
supply
chain
security,
which
has
already
been
mentioned
before,
I.e.
these
are
all
the
threats
that
arise
when
we
rely
on
someone
else's
code
packages,
library
framework.
We
all
know
that
modern
projects
are
built
on
many
dependencies,,
the
same
react,
but
written
somewhere
outside
our
company,.
We
all
rely
on
them,.
B
They
allow
us
to
speed
up
and
simplify
development,,
but
on
the
other
hand,
we
don’t
know
if
there
were
any
vulnerabilities
what
this
could
mean
specifically
for
our
applications,.
The
second
side
of
the
issue
is
security
to
an
ode
that
our
internal
team
writes,.
Some
programs
are
based
on
some
low-level
CCI,
plus
plus
the
code
that
is
written
there
with
a
minimum,
and
other
applications,
on
the
contrary,
rely
on
different
input
data
from
the
user
for
actions
with
the
user,,
and
here
a
number
of
questions.
Arise:.
B
Because
in
the
modern
world
we
use
more
and
more
complex
technologies
to
improve
speed
up
development
on
the
one
hand,
it
sort
of
simplifies
and
speeds
up
the
process,,
but
on
the
other
hand,
it
becomes
more
and
more
difficult
to
secure
the
code
and
find
possible
holes
and
holes
in
security,.
We
are
now
connecting
everything
to
the
Internet,,
creating
a
web
interface
and
again
using
the
same
flynn,
slides
and
librery
on
the
backend.
We
add
some
databases,.
We
combine
all
this
into
one
large
system
in
production,,
but
what?
B
If
the
given
one
who
enters
and
the
same
user,
goes
through
the
whole
code
when
it
turns
out
to
be
a
sequel
to
faith,
if
we
have
an
understanding
that
we
are
protected
from
such
situations,
that
we
have
thought
through
everything
in
advance,
again,.
Can
each
specific
developer
be
sure
that
changing
his
specific
change
that
he
makes
to
the
code?
B
Does
not
open
the
entire
product
for
a
number
of
vulnerabilities,
of
course,
I
would
not,
by
default,
perceive
all
users
as
potential
hackers;
I
would
also
not
trust
them
unconditionally
and
still
hope
for
some
more
modern
practices
in
writing.
Secure
code,-
and
here
we
move
on
to
the
main
topic
on
my
story
of
how
git
hop
generally
helps
developers
reduce
the
risks
associated
with
writing
code
and
with
the
safety
of
this
code,.
Of
course,
it
is
with
the
help
of
tools.
Menta
has
a
taste
for
them,
and
cats.
B
Cat
scanning
helps
to
find
through
bugs
with
automatic
code
scanning,
is
a
tool
that
puts
developers
at
the
center
of
the
security
process.
We
want
developers
to
use
code
scanning
to
fix
potential
threats
before
the
code
is
graduating
from
production
or
even
better.
We
want
so
that
they
fix
vulnerabilities
before
the
code
is
merged
into
the
main
branch.
We
focus
our
product
on
developers.
First,
of
course,
because
this
is
the
main
value
of
github.
We
always
put
the
developers
center.
B
Second,
simply
because
it
makes
sense
if
you
scan
the
code
more
often,
you
find
a
problem,
the
faster
you
resolve
them
faster.
If
the
developer
gets
feedback
right
after
the
changes
are
made,
he
can
still
be
in
the
same
branch.
His
file
with
the
change
can
still
be
opened
and
then,
when
he
gets
the
feedback,
he
fixes
the
bugs
faster.
On
the
other
side,
when
we
do
the
scan
not
1
or
2
times
a
year,
the
situation
is
completely
different.
The
developer
can
go
to
another
team.
B
People
who
support
the
code
are
not
familiar
with
it
all.
This
takes
time
all
this
takes
effort
and,
as
we
know,
time
often
equals
cost.
So,
of
course,
the
situation
is
completely
different
here
that
the
scanning
code
uses
to
directly
analyze
the
code.
As
already
mentioned,
the
scanning
code
uses
the
Yale
kotke
engine
to
do
static
analysis,
but
this
is
not
the
only
engine
that
can
be
used.
We
now
have
14
third
party
engines
and
we
are
constantly
adding
new
partners,
I.e.
B
B
That
it
extracts
all
your
code,
a
special
database
that
is
very
similar
to
the
same
May
ale,
but
with
a
special
format
that
allows
for
more
advanced
analysis.
Like
any
other
database,
we
can
write
to
it
by
cable
to
understand
what
is
inside,
but
in
our
case,
queries
will
cover
security
knowledge
from
hla
moreover,.
This
knowledge
is
taken
from
real
security
experts,
for
example,.
B
So,
for
example,
analyzing
the
data
flow
and
tracking
this
flow
through
the
entire
application
is
a
key
point
for
finding
many
vulnerabilities
again
site.
Template
injection
server
is
also
a
vulnerability
which
shows
us
that
there
is
a
possibility
that
unverified
data
is
provided
and
the
use
will
go
through.
The
entire
application
will
stop
of
stop
in
a
potentially
dangerous
place
and
open
us
for
hacking
and
when
the
glue
cat
finds
such
a
dangerous
pattern,
and
we
of
course
show
you
will
receive
a
security
alert
either
in
the
github
interface
or
through
it.
B
B
About
this,
today,
I
will
show
you
how
much
we
have
a
loggia
application
using
templates
and
jess,.
You
can
activate
the
code
scanning
function
in
the
repository
with
a
kotka
bag,,
then
I'm
going
to
slightly
improve
my
code
from
the
blood
wig
weight
for
this
and
we'll
look
directly
how
the
scanning
cat
already
automatically
checks
my
play
quest
and
what
it
finds
or
doesn’t
find
there
now,
let’s
move
on
from
the
slides,,
my
repository
in
which
I
already
have
a
file
under
the
file,,
because
we
do
it
for
more
minutes,
that
we
have
everything.
B
Here,
it’s,
extremely
simple,
I
have
a
form
in
which
I
will
ask
the
user
to
enter
his
age
and
a
button
allowing
him
to
do
this
in
general,
to
do
it.
Earlier,,
I
haven’t
finished
my
application.
Yet,
I
don’t
have
a
2nd
form
that
will
display
something
for
confirmation,,
so
I’ll
just
display
generic
everything.
Elementary,
let’s
see
how
it
works,
I
have
already
finished
this
code,
and
the
price
on
the
local
machine
is
simple.
For
clarity,.
Here
is
the
amis
form?
B
How
old
are
you,
I
say
that
it’s
not
much
more
than
its
submit
button
and
get
this
sell
everything
while
it’s
planned,
as
I
said,
earlier,
I’m
a
product
manager
to
work
where
I
don’t
write
for
a
clip,,
which
means
that
my
knowledge
is
given
somewhat
unreliable.
So
I'm
going
to
go
back
to
my
repository
without
activating
the
code
scanning
function
there
to
know
that
I
'm
doing
everything
right.
B
Let's
see
how
it
happens,
we
need
to
go
to
the
security
tab,
and
here
we
see
that
get
up
already
provides
us
with
many
tools
to
make
ours
safer.
Now
this
is
all
a
very
big
topic
to
regret.
So
let's
concentrate
now
on
codes.
Calings
is
a
command
that
works
with.
What
we
do
is
a
tool
that
allows
you
to
perform
static
analysis
of
the
code,,
so
I
have
not
activated
the
repository
yet,,
so
I'm
going
to
do
it
right
now,
when
we
press
the
activate
button,
it
looks
something
like
this
on
this
page.
B
We
can
see
that
gives
us
a
lot
of
engines
that
we
can
activate
even
within
the
team.
We
prefer
to
think
of
it
as
a
car
and
engines
that
you
can
insert
this
car
actually
from
different
manufacturers
with
different
functions
with
different
power
and
so
on.
Of
course,
we
prefer
to
use
our
own
qr
code
analysis
of
so
this
is
what
I'm
going
to
activate
right.
Now,
let's
click?
U
start
this
workflow
myself,
and
now
you
see
that
the
scanning
code
is
activated
with
a
big
action.
B
B
Any
other
sit
system
like
james
ken
jenkins,
trailer
miles
circles
so
I
add
a
pit
file
to
the
repository
that
will
define
how,
when
the
analysis
of
my
code
will
take
place
specifically
here,
I
want
that
for
each
that
when
I
push
the
main
branch
or
do
not
open
the
wesg
doormat
of
the
main
branch,,
the
scoring
code
analyzes,
my
code,,
there
are
also
conditions
under
which
the
scanning
code
will
analyze
some
pre-
installed.
While
what
we
call
good,
as
you
can
see,
this
pool
form
is
automatically
generated.
B
B
It
always
happens
during
the
first
installation
and
I'm
just
going
to
go
and
make
what
form
in
myself
to
the
maximum,
because
people
who
work
with
more
complex
systems
who
have
a
more
complex
workflow,
can
modify
this
train
theme
in
order
to
integrate
to
sky
link
with
their
workflow
was
the
most
smooth
and
seamless.
So,
of
course,
we
have
a
lot
of
modifications
and
the
ability
to
change
the
initial
initially
to
the
string
that
we
offer,
but
in
my
case
I
don't
need
any
additional
features.
B
B
We
make
changes
commit
directly
to
the
main
branch
and,
as
we
saw
in
mine,
I
am
Malfoy,
did
I
indicate
that
I
want
to
analyze
any
husband
that
will
be
done
by
the
main
branch.
So
now
I
expect
that
the
copy
has
already
started
and
already
analyze
something
let's
go
check
here.
We
are
we
go
into
the
actions
and
see
that
we
have
a
glue
cat
in
our
workflow
and
our
mid-layout
is
already
happening,.
Let's
leave
the
analysis
to
be
completed
and
return
to
my
departure,
as
I
said,.
B
We
want,
I
want
to
improve
it,
a
little,.
So
let's
do
it
now
and
do
it,.
We
remember
that
I
was
not
here.
Any
form
was
then
I
already
have
the
code
that
I
want
so
I'm
going
to
use
it
here.
Let's
just
use
it
here,
st-1
here
I
'm,
going
to
take
my
user's
age
and
create
a
form
that
says,
checked
out
their
age,
so
I'm
going
to
tell
the
body
what
time
it
is
exactly
like
this
here,
I'm
a
fictitious.
Let's
make
a
request
field
from
our
changes.
B
And
if
we
wait
a
little
bit,
we
will
see
right
here
how
the
cat
quelle
at
the
beginning
began
to
analyze
my
gender
request.
Already,
probably
everything
about
it
and
at
this
meeting
knows
what
a
class
is
for
what
they
are
used
for,
how
they
are
look
so,
of
course,.
We
will
not
dwell
on
this
and,
let's
see
how
my
modified
new
code
looks
like
I
have
also
launched
it
on
my
machine.
Let's
see
how
it
works,
even
the
most
form.
How
old
are
you?
B
I
say
it
was
a
lot
and,
yes,
you
are
a
lot,
the
exact
time
this
works
like
and
planned,
not
very
nice,
not
very
fun,
but
does
what
you
asked
a
while
we
return
to
our
pr
and
see
what
is
happening.
Here,
we
see
the
analysis
is
finished
and
something
broke
here.
It
goes
that
the
skyeng
vodka
code
found
one
error.
Let's
look
at
the
pain
in
more
detail.
What
is
it
there?
We
see
additional
information.
What
we
really
have
there
is
a
new
vulnerability
cat
injection.
Here
it
is
injection
code.
B
B
B
We
see
that
this
form
of
generation
is,
of
course,
processed
on
the
server
side
and
when
copying
the
value
of
this
me
favor
age,
given
m
to
non-
users,
I
have
opened
myself
up
to
a
whole
range
of
potential
problems
here.
The
simplest
is,
of
course,
cross
site
scripting,
but
perhaps
something
more
serious,
something
like
remote
code
execution.
Even
on
my
infrastructure,
this
sounds.
B
Mine
in
general,
to
the
main
branch
to
clearly
show
you
why
this
is
what
this
injection
implant
is,.
Let's
go
back
to
my
example
and
try
again,,
but
this
time
instead
of
the
age
value,,
we
will
enter
the
script
code.
There.
,
I
have
such
a
script,
that
in
general,
it’s
nothing
terrible
to
do,,
but
on
the
fingers
and
with
a
scare,
saying
boo,
we
introduce
it
and
really
it
is
executed,.
B
We
see,
I
hope
you
also
see
it’s,
not
very
scary
in
this
case,,
but
if
my
cat,
for
example,,
instead
of
talking
about,
removed
everything
cookies
from
the
session,
were
sent
to
an
external
server,,
then
I
could
steal
the
whole
session
entirely.
Here
is
such
a
whole
page
that
describes
here
Xia
what
exactly
the
problem
was
found,.
B
We
have
recommendations
that,
under
the
sky
link
gives
because
how
you
can
fix
this
problem
with
examples
of
possible
fixes
from
links
to
various
external
sources
of
when
this
problem
was
first
discovered
when
it
was
darkly
described
and
so
on
and
so
further,
I.e.
we
provide
detailed
information
on
how
the
problem
can
be
solved.
It
was
a
small
demonstration
of
the
scanning
code
and
how
it
works.
I
hope
you
were
interested
thanks
in
this
at
home
today.
I
will
show
you
how
we
need
the
application.