►
From YouTube: Meet the experts and supercharge your security testing with GitHub code scanning - Universe 2022
Description
Remember the days of security halting your release? Or when fixing results took months? Today, GitHub code scanning is defining the next paradigm for secure software development with testing in your workflow that you actually want to use. Join us for a fireside chat with some of the team behind GitHub code scanning to learn about how it evolved, how you can get more out of your security testing, and what’s coming next.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
A
B
B
A
B
It's
been
a
long
time,
so
it
it
came
about
has
a
spin
out
from
the
University
of
Oxford
almost
15
years
ago.
I
guess
at
this
point
and
we
started
out
kind
of
in
the
space
of
code,
analytics
code,
analysis,
work
through
code,
quality
and
Bug
findings.
Various
other
static
analysis
applications,
there's
a
there's
kind
of
a
fun
story
with
a
an
early
customer.
If
I
was
the
NASA
jet
propulsion
lab
wow
I
think
some
of
them
are
here
at
GitHub
Universe,
actually
so
give
them
a
wave
hey
folks.
B
So
when
the
mass
Curiosity
Rover
was
traveling
to
Mars,
that's
a
long
journey,
that's
like
seven
months
of
plummeting
through
space
and
I.
Don't
know
if
you
remember
they
had
this
really
complex
way
of
Landing
it
a
parachute,
a
sky
crane
with
boosters,
lowering
it
down
on
a
on
a
big
rope
and
they
were
testing
the
code.
While
it
was
going
through
space
and
as
one
does
as
a
developer,
they
found
a
bug
like
a
crushing
bug
in
the
landing
module,
and
so
we
got
an
angry
phone
call
saying
hey.
B
Why
didn't
you
help
us
track
this
down
like?
Well
sure,
but
none
of
the
other
tools
he
used
did,
and
so
we
said,
can
you
tell
us
what
the
problem
was
and
they
described
it
to
us
within
a
couple
of
hours,
we'd
written
a
query
on
coql
to
capture
that
problem
and
sent
it
across
and
they
ran
it
against
the
code.
It
flagged
the
original
problem,
but
it
also
flagged
a
number
of
other
instances
and
other
three
instances
in
the
same
Landing
module
and
others
elsewhere
wow.
B
So
they
were
able
to
fix
those,
and
we
got
permission
to
talk
about
the
story
as
long
as
the
landing
was
successful,
which
it
was
fortunately,
so
it's
been,
it's
been
great
fun
working
with
those
folks
and
so
from
then
we
kind
of
pivoted
a
little
bit
more
to
security
analysis,
because
that's
actually
the
space
where
you
really
benefit
from
having
custom
and
customizable
analysis.
It's
an
arms
race,
right,
yeah,
you're,
always
getting
vulnerabilities
coming
in
and
you
need
to
find
them.
B
You
need
to
adapt
your
tooling
to
respond
to
whatever
has
been
dreamed
up
by.
You
know
the
bad
guys,
and
so
we
started
working
with
the
Microsoft
security
Response
Center.
Actually
and
then
they
were
great
partners
from
there.
We
branched
out
to
every
other
big
tech
company
with
a
security
response
team
and
ultimately,
this
led
to
joining
GitHub,
which
has
been
a
really
great
cultural,
fit
right
at
Samuel.
B
A
B
And
there's
a
couple
of
aspects
here
so,
on
the
one
hand,
yeah-
and
this
is
an
advantage
of
static
analysis
in
general-
completeness-
can
mean
actually
analyzing
all
the
possible
execution
Parts,
the
entire
source
code.
Everything
about
it
again,
contrast
to
Dynamic
analysis,
where
you
have
a
particular
their
execution,
the
particular
flow
of
the
code
through
the
program
that
you're
observing
right
here
we're
trying
to
capture
all
possible
behaviors
complete.
This
is
also
about
having
a
good
enough
picture
about
the
threat
model
that
you're
operating
in
you
know
what
are
the
apis
that
matter.
B
Where
does
network
data
come
into
the
system?
What
are
the
sensitive
points
where
you
don't
want
attackers
to
be
able
to
reach
right?
And
finally,
of
course,
it's
also
about
just
supporting
all
the
codes
that
we
want
to
analyze
all
the
languages
that
people
use
all
the
new
versions
of
those
languages,
because
people
keep
making
them
better.
Of
course,
we
have
to
keep
up
with
all
that,
but
but
yeah
it's,
it's
all
a
good
fun
awesome.
B
B
B
That
are
in
there
and
we
can
never
give
you
a
guarantee
right.
The
people
will
always
find
vulnerabilities
that
you
haven't
thought
about,
but
we
do
try
to
track
our
the
effectiveness
of
our
analysis
against
Real
World
vulnerability.
So
we
will
look
at
the
stream
of
public
cves
and
we'll
check
how
many
of
those
our
analysis
flag
and
often
that's
one
of
the
best
ways
of
improving
the
analysis.
You
know
if
you
see
something
that
we
expected
to
flag,
but
we
didn't
well.
Why
not?
That's.
B
One
we're
developers,
I
mean
what
can
I
say
if
it's
not
fast,
I'm
not
going
to
use
it,
we're
not
going
to
use
it
right,
but
what
is
fast,
I
think
you
know
the
key
Criterion
is.
It
has
to
be
fast
enough
to
integrate
in
the
developer,
workflow
and
we
believe
a
sweet
spot,
for
that
is
in
the
pull
request
flow,
and
so
you
can
think
of
it
as
well
as
a
baseline.
It
should
be
as
fast
or
faster
than
the
human
review
right.
B
Wait
for
the
machines,
but
you
know,
of
course
that's
not
always
possible.
Speed
can
also
be
about
scalability.
We
do
a
lot
of
work
with
Microsoft
and
windows
is
probably
the
biggest
C
plus
code
base
in
the
world
and
analyzing.
That
thing
is
always
going
to
take
many
hours,
yeah
right
yeah,
but
the
key
is
in
that
context.
Speed
means
you
actually
are
able
to
scale
to
not
break.
When
you
look
at
180
million
lines
of
C
plus
plus,
you
actually
still
give
useful
analysis
results
on
that
code
base.
Awesome.
A
Awesome
well
now:
let's
talk
about
code
scanning,
so
code
scanning
allows
for
code
ql's
results
to
integrate
directly
into
the
developers
workflows
by
populating
right
in
GitHub.
This
means
that
developers
are
able
to
see
vulnerabilities
at
the
code
level
and
with
every
single
pull
request.
This
allows
them
to
easily
find
and
fix
vulnerabilities
early
in
the
development
process.
Exactly.
B
And
that's
our
philosophy,
right
security
tools
should
be
a
developers,
fingertips
and
code
scanning
or
codeql.
You
can
think
of
as
having
an
extra
security
reviewer
on
the
team
who's
just
going
to
look
at
every
PR
you
submit
and
just
flag
problems
that
you
might
be
introducing,
and
they
appear
just
like
any
other
request
feedback
that
you
might
get
from
your
teammates
right
right.
So
you
can
see
them
on
the
pull
request
view
you
can
discuss
them.
You
know
what's
going
on
here.
Is
it
wrong?
Is
it
right?
How
do
I
fix
it?
B
Is
it
fixed,
of
course,
when
you
do
actually
fix
it,
and
you
push
the
fix,
we'll
recognize
that
and
and
dismiss
the
the
comments.
So
it's
it's
the
right
point
to
integrate
security,
security,
tooling
and
code
scanning
in
general,
actually
acts
as
a
platform
for
other
static
analysis
too.
We
we
allow
dozens
of
Open,
Source
and
partner
engines
to
integrate
into
the
developer
workflow
in
the
same
way
as
we
do
with
codeql
as
our
in-house
analysis
tool.
B
Whoo
I
mean
the
team's
done
so
much
great
work.
It
can
be
hard
to
pick
favorites.
There's
a
few
that
stick
in
mind.
You
know
we
we
we
ship
the
feature
that
we
call
developer
friendly
alerts,
which
is
the
the
pull
request.
Integration
I've
been
talking
about,
presenting
it
right
there
in
the
flow,
rather
than
hiding
it
in
a
separate
Tab
and
we've
seen
huge
benefits
from
that.
Just
in
terms
of
Engagement.
B
In
terms
of
how
people
react,
how
people,
you
know
even
notice
the
alerts
right,
it's
easy
to
overlook
something,
that's
hidden
away
in
another
tab.
Another
one
is,
you
know
the
code
kill
engine
keeps
getting
better.
We
talked
about
speed
right
and
so
before,
GitHub
Universe
I
asked
the
team
to
pull
some
numbers
on.
You
know
how
we're
doing
against
last
year,
the
engine
itself
running
the
same
analysis
is
25
faster
today
wow,
and
this
is
just
the
start,
we
still
have.
You
know
lots
of
improvements
that
we're
gonna
make.
B
But
that's
that's
that's
key,
and
then
on
kind
of
for
each
of
the
analysis
and
on
completeness
as
we
as
we
spoke
about
before
we,
we
are
declaring
General
availability
for
Ruby
at
GitHub
Universe
this
year
and
we're
adding
support
for
more
programming
languages
that
matter
to
our
users
and
to
the
open
source
community.
So
the
key
ones
are
kotlin
and
Swift
right,
which
are
kind
of
the
big
mobile
app
ecosystems,
they're
underway.
We
expect
to
have
betas
in
the
next
couple
of
months
or
quarters,
we'll
see
how
that
goes.
B
There's
also
been
a
whole
bunch
of
work,
just
making
it
easier
for
security
researchers
to
share
their
work
through
through
on
and
through
codeql.
So
we've
improved
the
packaging
story.
We've
improved
the
tooling
that
they
use
to
write
to
write
queries.
We
improved
the
way
that
you
can
model
API,
endpoints
and
there's
just
so
many
things
that
are
going
on
in
code
scale.
I'm
super
excited
about
this
work.
Awesome.
A
B
There's
this
lot
like
this
again:
I
love
it.
You
know,
I
I,
want
to
go
back
to
the
speed
aspect,
So
the
faster
it
is,
the
better
we're
exploring
all
sorts
of
ways
of
improving
reliability
and
speed
of
the
analysis.
Part
of
that
is
the
engine.
Part
of
that
is
the
tools
that
extract
data
and
put
it
in
the
database.
Part
of
that
is,
you
know
the
surrounding
tooling.
Can
we
can
we
make
it
incremental?
B
When
we
look
at
a
pull
request,
can
we
only
do
work
proportional
to
the
diff
rather
than
to
the
whole,
commit
there's
actually
some
some
talks
going
on
here
at
Universe
about
very
early
stage
experiments
from
GitHub
next
about
what
it
would
take
to
make
even
more
of
the
engine
incremental
in
that
way,
wow
and
then
another
really
cool
thing
that
we're
focused
on
is
ease
of
use
and
ease
of
adoption.
Yes
right,
so
one
thing
we're
hearing
from
customers
is
hey,
it
can
be
difficult
to
roll
it
out
to
all
of
my
organizations.
B
I
need
to
commit
a
yaml
file
for
for
the
actions.
Workflow
I
need
to
maybe
specialize
it
to
my
particular
build,
and
so
we're
really
thinking
about.
How
can
we
make
that
experience
better?
How
can
we
just
let
you
as
an
admin?
Click
yes,
I
want
to
use
code,
ql
code
scanning
and
just
enable
it
on
on
every
repository
where
it
makes
sense.
Those
are
kind
of
things
I'm
again
looking
forward
to
over
the
next
few
months,.