►
Description
We’re all part of a deeply interconnected community, where the software we write builds on the work of others. Ninety-nine percent of new software projects depend on open source code. This extensive code reuse helps everyone build better software faster than ever before, but it also puts us all at risk of distributing security vulnerabilities from our dependencies. It’s more important than ever that every developer becomes a security developer—that they responsibly disclose vulnerabilities and patch vulnerable code quickly.
Today, we’re excited to announce several new security features designed to make it easier for developers to secure their code.
About GitHub Satellite 2019
A community connected by code
Explore our interconnected community—and how collaboration turns ideas into innovations.
Join us in November at San Francisco's Palace of Fine Arts for GitHub Universe - https://githubuniverse.com/
A
It
is
amazing
to
think
of
what
the
interconnected
community
can
do
for
software
development
right,
like
think
about
strangers
from
across
the
world,
coming
together,
collaborating
and
building
amazing
things
and
even
creating
human
progress
right.
That's
so
powerful
with
that
power,
there's
also
a
need
for
responsibility.
We've
got
to
build
software
that
is
secure
and
trustworthy,
because
the
strength
of
this
community
is
built
on
trust
right.
We
have
to
trust
each
other
and
the
software
that
we're
building
is
for
a
purpose.
A
It's
for
our
users
right
and
our
users
need
to
be
able
to
trust
that
software
and
trust
us.
So
the
challenge
of
open
source
security
and
Trust
isn't
some
abstract
thing.
It's
something
that
we
all
need
to
take
a
part
in
and
for
sure
there
are
challenges.
Let
me
tell
you
a
story:
this
is
the
story
of
something
called
event
stream
event.
Stream
is
a
node
module.
A
It's
used
in
tens
of
thousands
of
projects,
including
in
a
lot
of
enterprises
and
event
stream
is
maintained
by
one
developer
and
an
amazing
developer,
who
builds
a
lot
of
other
popular
software
projects,
and
one
day
he
got
approached
by
another
developer,
who
offered
to
make
event
stream
better
and
of
course,
he
accepted
that
offer
right.
It's
what
you
do
in
this
open
source
community.
A
When
people
want
to
help
you,
you
trust
them,
but
this
person
was
a
malicious
actor
and
what
they
did
was
they
put
a
vulnerability
into
event
stream
and
they
got
it
published
and
they
did
it
actually
very
cleverly.
They
put
it
in
a
dependency
and
made
it
very
hard
to
detect
and
it
took
almost
a
month
for
that
issue
to
be
found,
and
in
that
time
the
package
got
downloaded
millions
of
times.
This
could
have
been
a
disaster,
except
that
they
decided
to
do
a
very
specific
attack.
A
They
didn't
attack
everyone,
they
attacked
one
app
that
was
using
event
stream.
It
was
a
Bitcoin
wallet,
app
called
copay
and
sure
enough.
Copay
picked
up
that
package.
They
ended
up
having
to
deal
with
their
users
and
send
them
warnings,
but
it
could
have
been
a
lot
worse.
All
right
and
these
kinds
of
challenges
are
gonna
happen
and
and
not
just
because
there
are
malicious
actors
out
there,
but
because
of
us
because
we're
humans
right
humans
make
mistakes
and
when
those
lead
to
vulnerability
issues,
we
need
to
deal
with
them.
A
So
we
can
all
use
better
tools
to
help
us
do
that
now,
github.
We
believe
that
the
power
of
that
interconnected
community
that
helps
you
build
software
also
helps
you
build
more
secure
software.
If
you
think
about
all
the
people
involved
in
this
right
and
keeping
stuff
secure,
you've
got
researchers
who
are
finding
issues
maintain
errs
were
having
to
go
fix
them,
developers
we're
having
to
stay
on
top
of
their
dependencies
and
make
pickup
those
changes,
and
then
security
teams
or
we're
kind
of
keeping
an
eye
on
it.
All.
A
We
need
to
help
everyone
collaborate
better,
so
we
can
be
more
secure
and
I
want
to
share
today.
Some
of
the
tools
that
github
is
providing
to
help
do
that.
So,
let's
start
with
developers
and
administrators
now
in
November
2017,
we
release
something
called
security,
vulnerability
alerts
for
github,
with
this
github
now
actually
scans.
All
of
your
dependencies
and
continuously
compares
them
against
vulnerability
data
and
sends
you
an
alert
whenever
you've
got
a
vulnerable
dependency
because
we're
github.
We
can
do
this
on
a
planet
scale.
A
So
with
this,
even
if
you're
doing
local
development
insert
on
your
server,
you
can
connect
to
github
and
you
can
get
the
same
alerts
to
help.
Keep
your
code
secure.
I'm,
also
excited
to
announce
today
that
we're
partnering
with
white
source
and
white
source
is
an
industry
leader
in
vulnerability
data.
They
collect
vulnerability,
data
from
lots
of
different
places
and
thanks
to
white
source.
We
are
now
making
that
vulnerability
data
available
through
alerts
in
github,
so
we're
very
excited
about
that
partnership.
A
Now
alerts
are
great,
but
what,
if
you
want
to
keep
on
top
of
all
of
your
dependencies
right,
github
dependency
insights
helps
you
do
that
think
of
github
dependency
insights
as
a
full
overview
of
all
of
your
dependencies.
So
you
can
go
and
understand
each
dependency.
You
can
go
look
at
what's
changed
there,
who's
working
on
it.
A
Now
let's
go
ahead
and
look
at
how
bugs
get
found
and
fixed.
Now
at
github,
we've
got
a
dedicated
team
that
works
on
security
issues.
It's
an
amazing
team,
but
if
you've
got
an
open
source
project
right
for
a
maintainer.
This
is
a
hard
problem
right,
because
if
a
security
issue
comes
in
from
somewhere
all
of
a
sudden,
this
interconnected
community
becomes
a
very
our
place
right.
You've
got
to
go
race
against
time
to
go,
investigate
the
issue
figure
out
what
happened?
A
We've
got
to
go
figure
out
a
patch,
get
that
patch
built
and
tested
get
it
out.
There
issue
an
advisory
and
all
the
time
you're
hoping
that
you
don't
show
up
on
Hacker
News
right
right:
it's
not
not
fun.
Is
it
fun?
No,
so
what
you
need
is
better
tools
to
do
that
and
today
we're
announcing
a
tool
set
of
tools
to
help
you
so
first,
how
does
a
security
researcher
find
you
well
in
the
industry?
There's
a
convention
for
this.
Every
big
project
has
it:
it's
called
a
security
policy.
A
It
helps
researchers
understand
how
to
disclose
bugs
responsibly
to
you.
Now
you
can
have
a
security
policy
too,
because
we're
building
that
into
github.
So
with
github
security
policy.
You
can
now
author,
a
security
policy
for
your
project
or
you
can
author
it
for
your
entire
org
and
it
will
automatically
cascade
down
to
every
repo
and
now
researchers
know
how
to
work
with
you.
A
That's
an
important
first
step
now
once
you've
got
that
what
happens
when
an
issue
comes
in
right,
like
what
you'd
like
to
do
is
you'd
like
to
go
to
a
nice
place
with
the
people,
you
trust
in
a
private
environment
and
be
able
to
investigate
that
issue,
and
you
can
now
do
that
with
something
called
maintainer
security
advisories.
Let's
take
a
look
at
how
it
works,
so
a
new
issue
comes
in
and
what
I
can
do
is
go
ahead
and
create
something
called
a
draft
advisory.
A
This
is
something
new
in
github
that
we
are
announcing
today,
so
once
you've
done
that.
What
what
you
now
create
is
this
kind
of
entire
private
workspace,
where
you
can
work
on
the
problem,
so
you
can
invite
in
the
people.
You
trust,
maybe
that
security
researcher
the
file,
the
issue
you
can
go
discuss.
You
can
go
investigate
in
a
completely
private
space
when
you're
ready.
You
can
create
something
called
a
temporary
private
Fork.
A
This
is
a
completely
private
Fork
of
your
code
that
is
available
only
to
the
people
that
you
invite,
and
now
you
can
work
with
them.
Honestly
purity
issue:
you
can
build
and
test
the
patch
you'll
get
a
unique
get
URL,
so
you
can
use
it
with
your
get
tools
and
when
you're
ready,
you
can
go
ahead
and
merge
that
pull
request
back
into
your
code.
We
also
provide
a
set
of
tools
to
help
you
author,
that
advisory
and
submit
it
to
get
up,
and
when
you
do
that
will
take
care
of
the
rest
for
you.
A
A
So
with
these
tools
and
working
together
with
our
great
security
vendors,
such
as
hacker
one,
we
want
to
build
these
kinds
of
security,
best
practices
directly
in
the
github.
Now
organizations
like
the
CN
CF
have
a
bunch
of
custom
security
tools
today
and
they're
going
to
be
switching
to
using
a
lot
of
our
github
tools
and
we're
going
to
be
working
with
them.
But
you
can
have
these
tools
too,
because
our
maintainer
security
tools
are
going
to
be
available
to
every
single
open
source
project
for
free.
A
So
now,
let's
get
to
the
hard
part
doing
those
patches
yeah.
Now
it
turns
out
the
industry.
Data
shows
that
more
than
70%
of
vulnerabilities
actually
remain
unpatched
for
three
months.
A
lot
of
them
go
over
a
year
and
you've
probably
seen
some
news
stories
about
this
right.
We
can
do
better
right,
so
we
went
looking
at
how
people
have
tried
to
solve
this
problem,
how
people
are
dealing
with
it?
A
What
we
actually
found
was
a
number
of
partners
in
our
ecosystem
have
tried
to
already
go
solve
this
problem,
and
one
of
them
is
dependable,
so
dependable
is
a
product
that
takes
a
great
approach
to
trying
addressing
this
problem
of
patching
vulnerabilities.
So,
to
tell
us
more
about
it,
I'd
like
to
invite
the
co-founder
of
dependable
gray
Baker
to
the
stage
great.
A
B
In
2004,
I
was
working
at
a
start-up
and
one
of
my
Jobs
was
managing
our
dependencies.
We
were
payments
company,
so
we
really
cared
about
stability,
but
we
also
didn't
want
to
end
up
on
outdated
or
insecure
dependencies.
We
wanted
all
the
great
features
that
maintainer
czar
pushing
all
the
time
and
what
we
decided
was
that
the
best
approach
was
to
update
our
dependencies
little
and
often
so
we
always
knew
exactly
what
we
were
deploying.
They
were
always
just
small
changes.
B
The
problem
was
that
that
required
me
to
create
dozens
of
pull
requests
to
update
our
dependencies
every
single
week
and
they
were
beautiful,
pull
requests.
I
was
pulling
in
the
change
log.
You
know
any
release,
notes
that
were
there,
but
it
was
tedious
manual,
work,
creating
them
and
that's
what
we
built
depend
a
lot
to
solve.
So
you
build
a.
B
We
used
to
get
up
by
API
to
build
this
bot
and
it's
basically
like
having
me
on
your
team
of
they
seal
dependencies
for
you,
so
everyday
dependable
checks,
whether
or
not
you're
using
the
latest
version
of
everything
that
you
depend
on
and
if
you're
not,
then
it
opens
individual
pull.
Requests
to
update
you
I
think
we've
got
an
example,
pull
request
to
show.
B
So
in
that
pull
request,
you
can
see
it's
just
doing
a
very
small
update,
it's
a
patch
and
it
pulled
in
the
change
log,
the
release
notes-
and
in
this
case,
because
it's
fixing
a
vulnerability
details
of
the
vulnerability
that's
being
fixed.
The
idea
is
to
make
that
pull
request.
That's
easy
to
merge
as
possible,
so.
A
B
Exactly
so,
if
you
were
maintainer
and
you
push
a
new
version,
then
pretty
soon
dependable
will
create
pull
requests
for
everybody.
That's
using
it
to
update
to
that
version,
and
we've
had
over
500,000
of
these
pull
requests
merged
just
in
the
last
year,
including
by
some
fantastic
customers
who
have
really
helped
us
along
the
way,
with
grateful
for
all
the
feedback
from
folks
of
webpack,
mastodons
and
many
others.
Wonderful.
A
B
B
A
So
this
interconnected
community,
we
have,
we
believe
that
using
that
power,
together
with
great
tools,
helps
us
write
more
secure
code,
be
able
to
use
other
people's
code
with
more
confidence
and
ultimately
build
applications,
our
users,
trust
and
today
we're
giving
you
a
set
of
tools
to
do
that,
and
we
want
to
we'll
continue
to
work
with
you.
Thank
you.