►
Description
At GitHub, we know that open source data empowers the entire software development industry. That’s why we open source much of our security data, including the GitHub Advisory Database and CodeQL queries. We also cultivate a community of security researchers around the globe to enhance our open source data. Learn from Dan Shanahan, Senior Field Security Specialist at GitHub, and Kristian Lund, Director Field Security Specialist at GitHub, on how crowdsourcing security can change your response time to threats and how to help the community with your contribution.
Stay up-to-date on all things GitHub by subscribing and following us at:
YouTube: http://bit.ly/subgithub
Blog: https://github.blog
Twitter: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
Facebook: http://fb.com/github
About GitHub
It’s where over 100 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com
A
Good
afternoon,
thank
you.
Everyone
for
joining,
oh
great
I,
see
another
person
from
Amsterdam,
but
yeah.
We're
super
excited
to
have
you
all
here
for
our
GitHub
Galaxy
talk
on
security
and
the
Amia
track,
and
we're
going
to
be
talking
about
how
you
can
use
our
Global
community
of
security
researchers
to
scale
your
security
team.
A
You
name
it
and
I'm,
based
in
Amsterdam,
as
I
said
before,
and
yeah
I'm
I
have
a
background
in
front-end
development.
So
I
also
know
what
it's
like
to
be
faced
with
security
issues
and
not
really
not
really
know
what
to
do.
But
I'm
happy
to
be
joined
here
by
Nick
who's
going
to
talk
to
us
about
security
too
Nick.
Do
you
want
to
introduce
yourself.
B
Yeah
I'll
be
super
short
and
sweet.
My
name
is
Nick
I'm,
one
of
the
directors
here
at
GitHub
dedicated
to
Advanced
security
developer
by
background,
mainly
JavaScript
and
typescript,
so
any
JavaScript
type
developers
in
the
audience
a
big
shout
out,
I
am
based
in
Reading
and
as
I
mentioned
earlier,
I
am
an
avid
golfer.
So
I
am
super
excited
to
walk
through
I
guess,
like
generic
open
source
security.
Today,
really
looking
forward
to
the
chat.
A
A
If
you
can't
see
us,
then
try
refreshing,
but
there's
going
to
be
someone
in
the
chat
that
can
help
you
out
with
that
stuff
as
well,
and
the
main
thing
I
want
to
say
like
our
goal
today
is
that
we
want
to
have
a
conversation,
and
we
really
want
to
talk
to
you
all
and
there's
a
few
ways.
We
can
do
that.
We
do
have
a
chat
function,
so
you
can
chat
with
others.
You
can
chat
with
our
chat,
moderators,
Richard
and
Babu,
and
we
also
have
a
video
q
a
option.
A
C
A
Get
back
in
touch
with
you!
Thank
you,
okay,
on
the
video
q
a
so
you
can
raise
your
hand
with
this,
raise
your
hand,
button
there's
going
to
be
times
where
you
can
do
that
and
we'll
we'll
have
you
come
up
on
screen
and
on
video,
actually,
if
you're
comfortable,
so
we
have
a
dedicated
q
a
session
at
the
end,
but
also
at
any
time
like
while
we're
talking
and
doing
polls
or
talking
about
something
that
you
find
interesting
or
have
a
question.
Please
don't
be
shy.
A
B
C
B
We
have
a
right
that
we
have
a
very
diverse
audience
day
from
our
locations
and
also
a
a
job
perspective.
We
off,
we
often
see
I,
guess
software
development,
Leading
The
Way
with
devops
seconds,
but
it
is
really
nice
how
we
have
a
a
variety
and
like,
hopefully,
throughout
the
session,
we
can
get
various
people's
people
people's
thoughts
on
this.
A
D
A
A
I
want
to
get
a
feel
for
how
you
all
actually
feel
about
open
source.
So
anyone
want
to
be
our
first
guest
on
stage
and
and
talk
about
this
and
and
how
you
how
you
feel
about
collaborating
with
the
open
source
community
nice
I
see
that
we
have
our
our
first
person
volunteering,
so
summon
I'm
going
to
approve
you
and
have
you
come
on
up.
D
Go
with
college
please
it's
right.
My
point
is
I.
Do
find
the
point
to
idealistic
point
of
Richard
stolen,
but
that
is
some
more
again.
Your
topic,
so
should
we
say
open
source
is
the
way
to
socialize
the
internet,
the
developers
community
and
the
the
possibility
to
just
generally
yeah,
develop
together
in
collaboration
and
everyone
looking
into
their
own
mistakes
and
everyone
looking
into
everyone
else's
mistakes
and
making
something
nice
out
of
it.
B
Yeah
I
I
think
that's
so.
Firstly,
thank
you
for
coming
on
stage.
I.
Think
like
like
really
really
good
point.
I
didn't
like
the
way
that
we
think
about
open
source
mainly,
is
how
we
can
not
oh
I
would
say
not
like
look
at
mistakes,
but
more
like
learn
from
how
other
people
do
things,
but
also
more
work.
B
Thank
you
for
coming
on
stage
and
with
that
I
think
Santa
should
we
should
like?
Should
we
first
should
we
get
get
things
kicked
off,
yeah
amazing,
so
I
didn't
like
like
as
we
go,
go
through
this
we're
obviously
talking
about
open
source,
and
it
would
be
a
very
closed
Source
thing
to
do
to
just
be
like
it's
me
and
Center.
So
we
want
to
run
this
session
very
open
source
as
well.
So
again
like
please
like
wherever
it's
about
open
source
security,
whether
it's
about
like
just
general
developer
security.
B
We
have
some
devops
people
would
love
to
get
your
thoughts
either
way.
So
please
do
come
up
on
stage
or
or
ask
your
questions
in
the
in
the
poll
in
the
chat,
as
Senna
said,
we're
really
going
to
focus
this
talk
on
the
power
of
Open
Source
and
making
your
organization
security
team
as
big
as
it
can
get,
and
what
some
of
the
values
are
in
that
we're
going
to
focus
on
static
analysis
and
supply
chain,
because
they
are
two
of
the
most
relevant
topics.
B
E
B
A
devops
devsecops
conference
in
San
Francisco
talking
about
what
makes
a
security
tool
a
good
security
tool,
and
someone
said
this
phrase:
a
great
security
tool,
but
with
poor
data,
it's
just
like
driving
a
brand
new
shiny
car,
but
with
an
old
engine.
It's
gonna
look
really
really
good
and
on
paper,
when
you
trial
it,
it's
going
to
be
amazing.
But
when
you
go
to
use
it,
it's
really
going
to
let
you
down
and
I.
B
It
took
me
a
long
time
to
really
process
what
that
meant,
but
like
on
a
high
level
like
you,
can
have
a
security
tool
with
the
best
user
experience
with
like
the
best
prioritization,
and
it
will
go
ahead
and
prioritize
your
alerts.
It
will
make
everything
really
critty,
but
if
you
don't
have
the
right
data
in
that
tool,
when
the
data
isn't
top
quality.
What
is
what
is
the
point
of
that
experience
like
everything
is
backed
off
of
the
data,
the
remediation,
the
coverage
and
I
think
like.
B
That
is
why
GitHub
has
really
taken
a
broad
focus
on
data
and
making
sure
our
data
is
available
in
the
open
source.
So,
if
you
can
move
on
to
the
to
to
the
next
slide,
I
think
like
that's.
Why
I
really
want
to
focus
the
majority
of
the
SAS
and
the
Sea
part,
especially
when
it
comes
to
the
leveraging,
the
Global
Security
teams
on
data
and
how
we
can
leverage
our
open
source
security
researchers
to
make
data
the
best
possible
way
as
possible.
B
B
B
There's
about
570
times
more
developers
than
there
are
security,
researchers
and
that's
why,
when,
when
we
talk
to
companies,
we
often
hear
the
phrase
we
have
a
thousand
developers
and
we
also
normally
have
about
10
or
20
people
dedicated
to
application
security,
and
that
is
the
reality
of
today's.
We
have
so
many
people
that
focus
on
software
development.
B
We
don't
have
the
security
people
to
actually
scale
to
the
number
of
developers.
We
have
out
there
and
that's
why
one
of
the
main
things
GitHub
has
me
focusing
on
is
a
tool
called
coql
in
a
static
analysis,
space,
so
Center.
If
you
can
move
on
to
the
next
slide,
for
the
people
that
don't
know,
coql
is
a
static,
account
analysis.
Well,
it's
a
semantic
analysis.
B
Engine
and
people
often
refer
to
it
as
a
sales,
static
analysis
and
one
of
the
key
aspects
of
coql
is
it
allows
you
to
query
your
code
as
data,
so
we
can
actually
find
vulnerabilities
in
your
code,
but
by
treating
it
as
data
and
not
as
code
now
we're
not
going
to
get
into
all
of
the
technicalities.
But
one
of
the
key
aspects
of
coql
is
it's
a
query
based
engine
and
what
does
that
mean?
B
Queries
are
able
to
be
shared,
reused
and
collaborated
on
so
again
and
that's
why,
with
code
ql,
we
have
fully
open
sourced
our
static
analysis,
engine
and
all
of
its
rules.
So
that's
why
you
can
go
to
github.com,
GitHub,
codeql
and
you're
able
to
go
in
there
and
see
all
of
our
queries.
Now
that
brings
tremendous
value
and
I.
Think,
like
one
of
the
best
ways
to
articulate
this
is
how
we
have
it
on
the
next
slide.
I
think
this
is
a
really
nice
example
of
why
this
works
and
why
this
can
work
for
you.
B
When
you
talk
to
another
security
companies,
their
their
queries
and
their
engine
is
really
their
secret
Source.
But
what
it
means
is
you
can
only
move
as
quickly
as
me
as
a
security
organization
as
quickly
as
my
internal
team
and
obviously
GitHub.
We
have
a
whole
organization
of
Engineers
that
are
focused
on
writing,
queries
and
modeling,
so
we
can
meet
the
oauth
top
10..
We
can
meet
the
Sans
25
and
we
can
do
all
of
the
basics,
and
we
can
make
sure
that
we
have
queries
that
can
support
you.
B
But
why
can't
we
take
this
further?
Why
can't
we
Leverage
The
Power
of
the
open
source
to
make
sure
that
we
can
leverage
Community
powered
queries
and
that's
why?
If
you
go
to
github.comql
and
go
to
the
insights
tab,
you
can
actually
see
that
GitHub
has
Community
powered
queries.
So
what
that
means
is
we
don't
have
to
work
as
quickly
as
our
internal
team?
Can
move
we
actually
move
as
quickly
as
the
open
source
Community
can
move
in
this
space?
B
So
what
that
means
is
we
may
have
one
of
our
customers
that
goes
I've
written
a
coql
query
to
solve
this
type
of
SQL
injection,
with
this
Library
I'm
going
to
make
a
pull
request
and
merge
that
back
into
GitHub,
so
every
customer
is
able
to
get
that
query
and
again.
Rest
assured.
It
goes
through
all
of
our
internal
quality
results.
B
It
will
go
through
rigorous
testing
at
scale,
but
one
of
the
main
reasons
why
we're
able
to
scale
and
why
the
light
of
Microsoft
and
use
code
URL
is
we're
able
to
scale
not
just
as
quickly
as
our
internal
team,
but
again
all
of
our
customers
and
again
because
we're
open
source
you
don't
just
have
to
believe
me.
You
can
go
there
and
actually
see
on
our
repo
by
checking
out
the
insights
tab.
So
that's
why
Community
powered
crew
is
for
you
as
a
security
organization
or
for
you
as
a
developer.
B
Again,
we
are
able
to
model
the
most
latest
version
of
typescript
or
we're
able
to
get
the
latest
queries
because
we
are
actually
leveraging
not
just
100
or
200
people
we
have
internally,
but
the
thousands
of
security
researchers
that
actually
come
in
and
contribute
and
in
our
in
our
open
source,
slack
Channel.
We
have
over
2
000
people
they're
able
to
come
in
and
are
talking
about
cope,
URL
we're
building
a
community
around
security,
so
organizations
are
able
to
leverage
that
effectively.
B
But
what
we
also
see
is
people
go
in
on
top
of
that,
but
because
we
actually,
because
we're
actually
like
open
source.
Our
query:
writing
you,
as
an
organization,
are
actually
able
to
go
out
there
and
write
your
own
queries
and
you
may
decide
to
contribute
them
back.
You
may
decide
to
keep
them
yourself,
but
again,
you're,
making
this
a
learning
experience,
you're
able
to
you're
building
a
community
around
security.
So
again
you
as
a
5
or
10
or
one
team
security
team.
B
You
are
leveraging
not
just
the
200
300
people
we
have
in
GitHub
dedicates
to
this.
We
are
actually
out
there
in
the
thousands
and
you're
leveraging
the
thousands
of
of
security
researchers
before
we
move
on
Center.
Are
there
any
questions
or
or
or
thoughts
we
wanted
to
shout
out
from
the
from
the
audience.
A
B
Yeah
I
think
that's
a
fantastic
question
so
in
the
spirit
of
Open
Source,
if
you
have
a
open
source
repo
on
GitHub
you're
able
to
leverage
coql
code
scanning
for
free,
maybe
Richard
or
Babu
in
the
GitHub
side,
moderating
the
chat
can
drop
a
link
for
how
to
get
started,
but
for
any
public
repos
on
on
GitHub
you're
able
to
leverage
code
ql
for
for
free.
So
you
can
come
in
and
see
your
so
you
can
like,
like
Run,
Security
static
analysis
on
your
code
base.
D
I
had
a
bit
of
a
question
like
I
I,
something
I'm
I'm
actually
like
having
a
difficulty
coping
with.
Regarding
also
my
thoughts
inside
the
chat
box,
I'm
wondering
if
I
was
using
hypothetically
a
few
years
ago
and
by
few
I
mean
about
probably
between
2008
2009
SQL
injections,
for
example,
sure
just
to
penetrate
systems,
for
example,
high
school
systems
and
so
on
and
so
on,
and
then
as
a
security
vulnerability.
D
That
was
an
issue
at
the
time,
I
believe
and
again
these
days,
I
consider
the
use
of
this
as
a
tool
to
transport
data
from
one
end
of
my
memory
to
to
another
end
to
the
memory.
How
do
I
cope
with
that
thought?
It
isn't
that
the
duality
of
the
idea
a
counter,
secure
and
again
inside
any
widen
area
network.
We
just
I
yeah
the
internet.
There
are
vulnerabilities
and
that's
that
we
just
gotta
like
secure
the
the
the
container
we
contain.
D
B
B
Nowadays,
things
may
be
more
like
most
equal
and
you
have
like
vulnerabilities,
have
matured
I,
think
like
and
like
and
like
I'll
piggyback
one
to
that,
like
security
changes.
Frequently
like
you
have
so
many
different
types
of
vulnerabilities
and
security
is
just
moving
at
this
rapid
pace
and
that's
why
I
think
like
that's.
Why,
like
leveraging
a
global
set
of
security
researchers
and
that's,
why,
like
almost
being
honest
and
actually
like
being
like?
B
Yes,
like
my
internal
team,
we
can't
keep
up
with
this
and
that's
why
we
want
to
go
forward
with
their
capability
or
we
want
to
leverage
a
service
that
leverages
the
open
source,
because
just
due
to
the
fact
that
security
is
able
to
scale
remote
in
multiple
different,
different
vectors,
so
I
think
like
just
like,
like
due
to
the
fast
movement
pace
of
security
and
I.
Think,
like
from
the
security
researcher
perspective,
I've
got
a
really
interesting,
slides
coming
actually
next,
so
so
Center.
A
B
Like?
Are
you
using
the
vulnerable
method
in
a
vulnerable
way?
And
there
was
this
massive
Panic
where
security
orgs
were
like?
Okay,
like
I,
have
like
a
hundred
supply
chain
alerts.
You're
gonna
have
to
fix
them
all.
We
have
no
idea
which
ones
are
actually
vulnerable,
but
we
think,
like
originally
got
to
go
after
everything.
Now
GitHub
have
released
a
capability
called
multi-repository
variant
analysis,
so
again,
Richard
and
Beverly.
B
It
allows
us
to
be
a
bit
more
accurate
with
the
results
now
with
multi-repo
variant
analysis.
We
have
actually
been
storing
the
latest
version
of
that
database
that
you
have
been
running
code
ql1.
Think
of
it
more
like,
like
a
data
structure
and
with
multi-repo
variant
analysis,
you
can
run
a
single
query
across
all
of
them
databases.
So
if
you've
been
running
coql,
110,
000
repos
in
your
organization
again
you
we
now
have
the
latest
version
of
them
databases.
B
So
let's
say
when
the
next
log
for
J
vulnerability
comes
out
and
your
CSO
or
your
head
of
security
comes
to
you
and
says:
hey
like.
Where
is
this
from
this?
This
vulnerability
in
our
in
our
source
code,
what
the
value
of
multi-looper
analysis
is
again
GitHub
may
go
out
and
be
like
hey
here
is
a
query
to
find
this
type
of
vulnerability.
This
pattern
in
this
application.
So
you
can
write
your
own
query
or
you
can
leverage
one
that
GitHub
has
provided.
B
You
can
plug
it
in
to
multi-repo
variant
analysis,
and
we
will
like
look
for
each
one
of
them
databases
and
see
if
you
have
any
type
of
vulnerability.
So
again
we
have
a
coql
query
for
log4j.
You
can
plug
that
straight
into
multi-repo
variant,
analysis
and
you
can
go
out
there
and
you
can
see
where
your
vulnerabilities
are
amazing.
B
B
No
you're
fine,
Santa
I
think
like
that
is
a
really
nice
example
of
a
capability.
But
again
you
may
not
be
able
to
to
go
out
there,
and
you
may
not
know
how
to
write
that
query,
but
because
coql
is
open,
we're
actually
able
to
go
out
there
and
you're
able
to
go
out
there
and
see
all
of
our
queries
and
you
can
like
Leverage
the
ones
that
we
provide,
or
you
can
leverage
the
ones
that
the
community
have
provided
and
a
great
example
of
this
is
when
log4j
did
come
out.
B
B
Have
to
message
your
security,
tooling
company
and
be
like
hey:
when
are
you
getting
the
vulnerability
out?
You
can
just
go
to
our
public
repo
and
you
can
actually
see
where
that
vulnerability
is.
So
that's
just
one.
That's
one
example
of
how
you
can
use
multi-repo
their
analysis.
There
are
many
different
ways
if
you're
a
bug,
Bounty
program
and
again
you
get
a
submission,
and
you
want
to
write
a
query
that
finds
all
of
the
types
of
that
of
that
bug.
Bounty.
You
can
then
run
it
across
all
of
your
code
bases.
B
B
Exactly
that
is
like,
like
you
can,
of
course,
one
coach
you
out
with
all
of
our
queries
in
it.
But
again
you
can
run
across
everything
but
again
like
if
you
have
the
next
look
like
look
for
Jay
or
the
next
big
part
of
the
big
bum
bum
ability,
you
don't
have
to
go,
go
to
Every
repo
and
kick
off
a
scan
or
go
to
your
toe
one
kick
off
a
scan
for
every
single
repo
for
every
single
result.
It's
going
to
take
a
long
amount
of
time.
B
So
again
like
like
one
one
example
is
a
vulnerability,
but
you
may
look
for
a
specific
header
like
in
like,
like
Coq,
is
a
query
language,
so
you
can
really
make
it
search
for
for
anything
and
multi-read.
Analysis
is
what
enables
it
at
scale
so
the
that
is
what
makes
this
this
usable
and
really
good,
really
good,
good
question.
B
A
B
No
I
think
like
you,
can
have
it
search
for
like
email
addresses
like
like
and
like
again
like
it
looks
at
your
built
code.
So
again,
like
you,
can
look
look
for
pi
and
logs.
It's
it's
super
scary
level,
but
I.
Think
the
the
other
aspect
of
this
is
the
code
scanning
and
the
Integrations
part
of
things
with
Advanced
security
and
code
scanning.
B
Again
like
we
realize
we
are
not
going
to
be
the
Best
in
Class
of
every
type
of
security
out
there
I
think,
like
the
person
that
came
up
on
stage
earlier
really
alluded
to
that.
They
said
like
hey.
There
are
so
many
different
types
of
vulnerabilities,
there's
container
scan
and
there's
Network
scanning.
There
are
so
many
different
types
of
scanning
and
GitHub
is
never
going
to
be
best
in
class
at
absolutely
everything.
B
But
we
want
to
try
and
provide
an
experience
that
your
developers
get
the
results
in
a
single
and
consumable
fashion.
And
do
you
do
you
as
a
Security
Org
of
x
amount
of
people
facing
off
to
X?
Hundreds
of
developers
want
to
maintain
and
run
five
or
six
different
tools
that
that
is
quite
a
lot
to
manage.
So
with
Advanced
security
and
with
code
scanning,
we
have
taken
the
approach
to
be
open
by
default.
One
of
our
core
principles
is
being
integratable.
So
again
you
can
go
to
the
actions
tab.
B
So
that
means
that
you,
as
a
security
team,
can
leverage
the
right
tools
for
you
without
managing
multiple
different
tools
and
don't
worry
you
don't
have
to
use
actions
whatever
CI
tool
that
you
have.
You
can
leverage
that
there
and
that's
really
everything
that
I
wanted
to
cover
in
the
static
analysis.
Section
like
I,
like
I,
wanted
to
give
time
for
questions
or
time
or
or
time
for
any
for
any
polls.
A
D
D
B
Yeah
that
is
so
yeah
I
think
like
like.
There
are
many
different
different
aspects
of
of
this
learning
like
data
there's
a
whole
different
aspect
of
like
data
security
and
I
suppose,
like
like
coql,
isn't
gonna
like
focus
on
like
what
we
are
really
trying
to
sell.
Like
our
main
problem
statement
from
our
side
is
I
would
at
a
high
level,
is
trying
to
get
security
into
the
hands
of
developers
and
making
it
in
a
developer
first
way,
whilst
also
making
sure
that
security
teams
have
what
they
need
to.
E
D
B
C
D
C
B
C
E
You
hey
Nico,
I,
have
a
question:
we
are
using
our
company.
All
the
advanced
security
tools
from
GitHub
and
I
have
something
that
I
want
to
to
check.
If
it's
an
opinionated
decision
but,
for
example,
code
ql,
you
can
run
this
on
pull
requests
and
make
sure
that
you
cannot
merge
a
pull
request
until
a
certain
threshold
of
security
is
solved.
What
about
depend
about
10,
Secrets
I
think
you
they
are
not
checking
poor
requests,
so
I
cannot
prevent
a
pull
request
being
merged.
E
E
B
There's
a
capability
called
dependency
review
so
like
with
Dependable,
we
have
a
capability
called
dependency
review,
it's
an
advanced
security
feature,
but
what
it
allows
you
to
do
is
on
a
pull
request,
you're
able
to
per
say
what
is
the
policy
that
I
want
to
allow
or
not
allow
to
be
approved
in
my
PR?
So.
B
That
Nick's,
a
developer
in
your
organization
and
Nick,
is
a
naughty
developer
and
he
introduces
a
really
bad
version
of
eslint
or
like
log4j.
You
can
set
up
a
policy
that
says
hey
in
any
PR
on
this
repo,
do
not
allow
any
more
higher
vulnerabilities
or
critical
probabilities
or
you
can
even
specify
licenses.
So
you
can
mention
hey,
don't
don't
allow
the
GOP
license
and
you
can
also
go
very
granular
and
say:
hey
only
apply
this
to
runtime
dependencies
and
not
Dev
dependencies
so
like
on
the
supply
chain.
B
Space,
I,
really
evangelize
that
you
check
out
a
feature,
call
dependency
review,
because
that
is
going
to
give
you
what
you
need
within
within
this
within
the
supply
chain,
space
on
a
secret
scanning
space,
github's
principle
was
the
moment
you
leak
a
secret,
it's
it
it's
compromised
and
we
flag
that
straight
away.
You
can
block
PR's
with
with
any
secrets
in
them.
There
is
a
open
source
tool
and
utility
out
there.
That
will
enable
you
to
do
that.
So,
as
you
mentioned,
with
code
ql,
you
can
natively.
B
Have
that
experience
where
you
block
it.
We've
depended
with
supply
chain.
You
have
dependency
review,
which
you
can
also
apply
at
an
organization
level.
You
can
also
say
this
is
my
org
level
policy
and
use
required
workflows
as
the
way
to
enforce
that
so
required
workflows
is
going
to
be
one
of
the
ways
that
you
can
enforce
it
at
York
level,
and
you
can
also
do
it
at
the
secret
scanning
level
does
does.
E
E
C
B
Think,
like
my
views
on
this,
is
yes
like
the
pull
request
is
where
you're
going
to
get
the
best
remediation
rights
like
GitHub,
on
public
repos,
has
about
a
70
remediation
rate
with
coql
in
in
PRS.
Prs
is
by
far
the
best
place
where
you
get
the
best
remediation,
so
whether
it's
supply
chain,
whether
it's
like
static
analysis
like
like
the
best
place
to
put
this,
is
in
the
pr.
So
the
answer
is
yes.
Yes,
yes,
yes,
and
yes
as
much
you
can
put
in
the
pr
without
overwhelming
the
developers.
B
A
A
A
B
C
You
my
question
is,
regarding
you
know,
replayability
or
replaying
your
code
against
the
vulnerability,
so
I
mean
yeah.
You
have
talked
about
analysis
and
you
know
figuring
out
what
the
vulnerabilities
in
the
course
order
and
especially
static
analysis,
but
we
usually
deal
with
you
know:
Finance
industry,
and
we
we
get
reports,
security
report
scams
from
the
different
banks,
analyzing
our
product
and
there
they
are
giving
us.
C
B
So
I
think
that's
by
the
way,
really
good
question
to
ask
I.
Think
that's!
Definitely
where
like,
like,
like
actions
and
more
like
but
like.
If
you
want
to
be
player
by
a
vulnerability,
you
need
that
environment
to
be
able
to
like
replay
it,
but
like
what
like
like,
although
like
most
static
analysis
tools,
are
very
static.
So,
like
they
look
at
the
code
and
they
run
your
code,
I
like
like
just
as
it
sees
it,
coql
will
actually
build
your
code,
so
we
actually
follow
the
qualifa
Java.
B
At
the
top
of
my
head,
but
what
about
but
but
I'm
more
than
happy
to
go
back
and
take
a
think
and
try
and
find
some
and
again
like
I,
think
we
like
but
like.
If
you
leave
your
details
or
request
a
demo
afterwards,
we
at
least
have
have
something
of
who
you
are,
and
we
and
I
can
try
and
have
someone
at
least
try
and
be
reach
out
to
you.
A
B
A
E
B
I
think
like
Philip's,
coming
and
I
hope,
I'm
saying
your
name
right
and
I
think,
like
small
teams,
rely
heavily
on
like
on
developers
to
implement
security.
A
hundred
percent
like
it
is
very
varied
like
like
just
like
some,
like
some
teams,
are
gonna
have
like
10
developers
where,
like
you're,
not
gonna,
hire
a
specific
security
person
for
at,
like
appsec
and
like
you
are
like,
but
for
the
larger
organizations
I
think
like
you
are
you're
gonna
have
more
security.
B
People
I
would
be
interested
if
any
organization
has
more
security
people
than
they
do
developers
I,
don't
like
like
that's
something
that
like
I'm,
always
interested
in
hearing
but
I.
Think
like
I,
like
I
agree
like
like
there's
like
the
statistic,
insignificance
like
across
the
mall
with
about
the
same,
but
it's
it's
just
interesting
to
see
how
you
have
30
of
organizations
or
like.
If
you
combine
the
bottom
two
you
have
like
nearly
60
Of
Orcs
that
have
a
greater
than
101
ratio
and
I.
B
A
B
Would
you
ask
the
maintainer
to
fix
it
like
like?
Would
you
would
you
actually
swap
it
out
for
another
dependency
I?
Think
like
oh,
do
you
do
what,
like
most
people
do
and
just
do
nothing
like?
What
do
you
actually
do
here
like
oh
like
do
you
do
something
else,
Fork
it
and
you
fix
it
yourself.
Oh,
that
is
also
a
very
calm
common
we've
seen
that
twice
now
really
interesting.
A
B
I
I
have
done
that
in
my
old
organization.
We
used
a
package
across
every
single
repo
and
it
was
used
to
cost
like
thousands,
we
we
was
going
to
have
to
remove
it.
It
was
a
critical
risk.
I
definitely
agree
with
one
of
the
points
in
it
in
the
chat.
It
depends
on
the
risk,
and
this
was
a
very
high
risk
vulnerability.
B
So
Twitter
we
went
through
through
Twitter
and
to
be
fair
like
they
did.
They
did
then
go
and
fix
it.
I'm.
A
big
believer
in
like
open
source
Community
does
this
on
the
back
of
their
heart
and
they
do
it
with
their
heart
on
their
sleeve.
So
I
went
like
I,
don't
want
to
bug,
but
that
was
but
I
I
did
do
that
once
yes,.
A
A
question
from
the
chat
actually
that
I'd
like
to
answer
that
I
think
is
a
really
good
thought.
So
Marco
asked
is
security
really
that
big
of
a
deal
everywhere
I
understand
it's
really
important
in
servers
systems,
networks
Etc,
but
in
some
simple
programs
like
music
players
that
are
only
playing
audio
as
a
feature
is
security
necessary
in
this
case
and
I
say
it
absolutely
is
like.
Maybe
a
repository
could
be
compromised
somewhere.
A
B
Yeah
I
think,
like
my
biggest
phrase,
is
like
in
the
security
world
like
there's
a
lot
of
like
like
people
like
change,
and
things
learn
so
so
so
quickly
think
about
how
log4j
was
announced
right.
It
was
announced
in
a
PR
on
a
repo,
and
it
calls
Mass
frenzy
with
a
login
package
like
who
would
have
thought
there'd,
be
a
vulnerability
in
like
a
login
package
and
could
cause
soft
debt
such
that,
like
detriment
so
I
think
like
I
agree
with
the
premise
of
your
question,
like
is
security
really
needed?
B
B
Protecting
everything
is
super
super
you
know
important,
and
the
responses
by
the
way
like
like
I
I'm,
really
proud
of
it
of
everyone
that
like
drops
an
issue
on
GitHub,
that's
absolutely
the
first
thing
that
I
would
do
going
going
forward
and
also
if
there
is
no
fix
swapping
out
the
dependency
based
on
the
risk
based
on
the
license.
I
didn't
like
it's
like
seeing
everyone's
thoughts
in
the
in
the
channel
definitely
agreed
with.
B
So
we're
gonna
have
to
move
through
this,
this
section
pretty
pretty
quickly,
but
I
want
to
remain
on
the
same
premise
of
data
but
in
the
supply
chain
world.
So
a
lot
of
you
may
or
may
not
know,
GitHub
has
its
own
advisory
database
and
you
can
see
that
by
going
to
Google
and
typing
in
GitHub
advisory
database-
and
you
can
see
our
our
advisory
database
and
all
the
advisories
that
we
have
reviewed
and
put
in
to
our
database.
B
It's
free.
It's
open
source
again
like
similar
to
a
lot
of
things
that
GitHub
does
these
open
source
maintainers
write
like
write
code
in
their
spare
time?
Not
many
of
them.
Do
it
for
a
full-time
job,
and
so
we
believe
they
don't
intentionally
write
vulnerabilities.
So
so
how
can
GitHub
support
and
leverage
that
open
source
community
in
an
as
well
open
way?
So
we
have
our
advisory
database.
B
It's
maintained
by
GitHub
with
a
full-time,
dedicated
creation
lab,
which
is
part
of
our
Amazing
Security
lab
team
and
again
because
GitHub
is
the
oh,
is
the
open
source
software
and
the
home
for
open
source.
We
have
a
built-in
disclosure
workflow
and,
with
all
of
that
in
2022,
we
had
a
fantastic
year
when
it
came
to
new
advisories
in
our
in
our
database
issued
with
new
CVS,
so
Center
it
it.
If
you
can
move
on
to
the
next
the
next
slide.
C
B
Right
for
new
vulnerabilities,
we
are
really
proud
of
the
work
that
we
have
tried
to
do
to
make
the
disclosure
process
easier,
but
also
to
leverage
open
source.
No
company
is
perfect
and
we
want
to
make
sure
that
we
have
the
best
data
that
we
can
give
people
and
that's
why
I
really
want
to
highlight
two
core
capabilities
that
came
to
our
advisory
database
last
year.
B
But
then,
if
you
can
move
on
to
the
next
slide,
one
of
the
key
key
capabilities
was
a
feature
called
Community
contributions
and
my
ask
to
everyone
in
this
audience.
If
ever
you
see
any
issue
with
our
advisory
database
or
if
you
see
any
Dependable
alert
or
anything
that
doesn't
feel
quite
right
and
you
think
it
can
be
better
leverage,
Community
contributions,
so.
B
Is
we
open
the
source
and
we
just
close
all
information
about
our
advisories
and
let's
say
you
get
a
Dependable
alert
and
you
think
the
description
isn't
good
enough
or
you're
like
hey,
there's,
not
a
fix
for
this
in
this
advisory,
but
I
actually
know
there
is
a
fix.
How
can
I
update
this
with
a
normal
security
tool?
You
have
to
contact
them,
get
an
email
off.
Ask
them
to
update
it,
we'll
do
it
in
a
week,
but
why
can't
people
do
that
themselves
with
GitHub?
B
B
So
this
is
one
example
of
how
we
can
leverage
the
community
to
have
better
software
and
again,
as
we
move
on
to
my
final
few
slides,
this
feature
is
definitely
close
to
home
and
it's
called
PVR
private
vulnerability
reporting.
So
again,
GitHub
is
the
home
of
Open
Source
software
and
the
biggest
problem
we
had
is
security.
Researchers
didn't
have
a
good
place
to
go
to
tell
a
package.
There
was
a
vulnerability.
Go
back
to
log4j
log4j
was
disclosed
in
a
pull
request
that
caused
absolute
Mass
Havoc
with
PVR
with
project
vulnerability,
reporting
security.
B
Researchers
are
able
to
disclose
vulnerabilities
directly
within
GitHub,
and
that
and
again
like
that,
is
one
of
our
key
capabilities.
Again
we're
trying
to
make
the
disclosure
process
easier.
We
want
to
make
sure
that
everyone
is
able
to
disclose
and
update
vulnerabilities
for
the
power
of
Open
Source.
Let's
leverage
all
of
you
that
again,
like
you're
all
out
there
using
these
tools,
you
can
contribute
back
and
you
can
make
these
tools
better
and
better.
I.
Think
like
that
really
focuses
on
our
on
the
keys
on
the
key
supply
chain,
asks.
B
A
E
B
B
Thing
that
you'll
never
hear
of
hit
here
here
from
GitHub
or
really
any
security
company
is,
is
saying.
These
tools
about
these
tools
are
fantastic,
really
good
tools,
but
we
do
not
use
sneak
or
or
white
sauce
as
our
as
our
open
source
data
engine.
No,
we
have
our
own
advisory
database
and
we
have
our
our
own
scanning
service
with
dependabot,
really
good,
really
good
question,
but
no,
we
do
not.
A
B
Just
want
to
say,
like
we
spoke
a
lot
about
data
in
this
talk
and
whilst
data
isn't
everything
like
data
is
at
the
heart
of
the
security.
So
when
that's
what
I
GitHub
is
going
to
do
everything
in
its
power
to
make
sure
that
we
Leverage
The,
gaping
Source
Community
to
have
the
best
new
data
as
we
possibly
can.
B
We
will
make
sure
that
again
we
have
a
great
remediation
experience,
but
if
you
don't
have
the
data
to
remediate
on
there's
not
much
to
it,
we
will
continue
to
make
sure
that
you
have
an
easy
enablement
experience,
but
once
you
enable,
if
you
have
nothing
to
actually
find
the
enablement
experience,
isn't
quite
there
same
with
detection
and
settings
and
same
with
coverage.
So
we
will
continue
to
grow
and
again,
I
will
finish
myself
on
the
quote
that
I
mentioned
earlier,
and
if
you
say
what
like
one
thing
away
and
if.
B
A
Yeah
I
just
want
an
echo
message,
thanking
everyone
for
coming
on
stage
like
throughout
and
asking
really
great
questions,
and
it
was
really
nice
learning
from
you
all
and
yeah
last
few
slides
so
we're
on
day
two
for
security,
there's
a
great
session
tomorrow
at
the
same
time,
about
collaboration,
so
I
encourage
you
to
join
those
sessions
as
well,
and
we
would
love
to
hear
from
you
and
get
your
feedback.
So
someone
is
going
to
be
sharing
a
link
to
the
survey
in
the
chat,
so
yeah
feel
free
to
yeah.