Microsoft GH-500 - Questions & Answers

By default, CodeQL scans on push and pull_request events to identify vulnerabilities introduced in commits or PRs.

Organization policies let admins enforce Code Scanning across all repositories, even newly created ones.

SARIF reports are stored as workflow artifacts for download and integration with external systems.

codeql database analyze runs queries against a prepared CodeQL database, generating SARIF output.

If a secret is intentionally used in a test environment and poses no real-world security risk, you may close the alert with the reason"used in tests". This helps reduce noise and clarify that the alert was reviewed and accepted as non-critical.

Just being in a test file isn't enough unless itspurpose is purely for testing.

GitHub secret scanning detects and alerts on sensitive data exposure, such as API keys and credentials, in your code repositories. Use it to protect your secrets, ensure secure and compliant development practices, and reduce the risk of data breaches and unauthorized access.

GitHub has scanned public repositories for secrets (like API keys and tokens) for several years. Secret scanning protects our partners and our customers from unauthorized use of the services protected by those secrets. Just this month, 8% of active GitHub repositories committed a secret that was caught by secret scanning.

At GitHub Satellite, we announced secret scanning for private repositories, part of GitHub Advanced Security. We're bringing the same lightning-fast scanning engine and broad set of 24 partners (including all the major cloud providers and many common SaaS providers) to your private repository, so you can catch secrets as soon as they're checked in. Repository admins will be notified about any commit that contains a secret, and can quickly view all detected secrets in the repo's Security tab.

Secret scanning push protection is a security feature that prevents sensitive information like API keys or tokens from being pushed to a repository in the first place. It works by proactively scanning code during the push process and blocking any attempts to commit secrets. This differs from regular secret scanning, which only detects secrets after they have been committed.

Adding a security policy to your repository
You can give instructions for how to report a security vulnerability in your project by adding a security policy to your repository.

About security policies
To give people instructions for reporting security vulnerabilities in your project, you can add a SECURITY.md file to your repository's root, docs, or .github folder. Adding this file to this part(s) of your repository automatically creates a row with a description where people can review it. When someone creates an issue in your repository, they will see a link to your project's security policy.

You can find security alerts from Dependabot, Secret scanning, and Code scanning under your repository's Security tab. Security alerts for a repository are visible to people with write, maintain, or admin access to the repository and, when the repository is owned by an organization, organization owners.