You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/concepts/vulnerability-reporting-and-management/about-your-exposure-to-vulnerabilities-in-your-code-and-in-dependencies.md
+13-11Lines changed: 13 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: About exposure to vulnerabilities in your code and in dependencies
3
3
shortTitle: Vulnerability exposure
4
-
intro: Understanding your organization’s exposure to vulnerabilities in first-party code and in all dependencies is essential for enabling you to efficiently assess, prioritize, and remediate vulnerabilities, reducing the likelihood of security breaches.
4
+
intro: Understand how vulnerabilities in your own code and in third-party dependencies contribute to your organization’s overall security exposure, and how to measure and reduce that risk.
5
5
allowTitleToDifferFromFilename: true
6
6
product: '{% data reusables.gated-features.ghas-billing %}'
Your organization has exposure to vulnerabilities in both the code you write and maintain, and in the open-source or third-party dependencies your code uses. Assessing your exposure to vulnerable dependencies is crucial if you want to prevent:
22
+
Your organization has exposure to vulnerabilities in both the code you write and maintain, and in the opensource or third-party dependencies your code uses. Assessing your exposure to vulnerabilities is crucial if you want to prevent:
23
23
24
24
***Unplanned downtime and operational disruption**. Exploitation of vulnerabilities can result in application outages, degraded service quality, or cascading failures in critical systems, disrupting your business operations.
25
25
@@ -31,7 +31,7 @@ Your organization has exposure to vulnerabilities in both the code you write and
31
31
32
32
***Regulatory and licensing issues**. Many regulations and industry standards require organizations to proactively address known vulnerabilities in their software supply chain. Failing to remediate vulnerable dependencies can result in non-compliance, audits, legal penalties, or breaches of open source license obligations.
33
33
34
-
Regularly assessing your exposure to vulnerabilities is good practice to help identify risks early, implement effective remediation strategies, and maintain resilient, trustworthy software.
## Ways to monitor your repositories for vulnerable code
37
37
@@ -41,17 +41,19 @@ Regularly assessing your exposure to vulnerabilities is good practice to help id
41
41
42
42
{% data variables.product.github %} provides a comprehensive set of {% data variables.product.prodname_dependabot %} metrics to help you monitor, prioritize, and remediate these risks across all repositories in your organization. See [AUTOTITLE](/code-security/concepts/supply-chain-security/about-metrics-for-dependabot-alerts).
43
43
44
-
## Key tasks for AppSec managers
44
+
## Reducing organizational vulnerability exposure
45
45
46
-
### 1. Monitor vulnerability metrics for dependencies
46
+
Reducing organizational vulnerability exposure requires ongoing visibility into risk, remediation progress, and policy enforcement across repositories. {% data variables.product.prodname_dependabot %} and {% data variables.product.prodname_code_scanning %} metrics provide this visibility. Use the following best practices to monitor and reduce your organization's vulnerability exposure:
47
+
48
+
### Monitor vulnerability metrics for dependencies
47
49
48
50
Use the metrics overview for {% data variables.product.prodname_dependabot %} to gain visibility into the current state of your organization's dependency vulnerabilities. See [AUTOTITLE](/code-security/security-overview/viewing-metrics-for-dependabot-alerts).
49
51
50
52
***Alert prioritization:** Review the number of open {% data variables.product.prodname_dependabot_alerts %} and use filters such as CVSS severity, EPSS exploit likelihood, patch availability, and whether a vulnerable dependency is actually used in deployed artifacts. {% data reusables.security-overview.dependabot-filters-link %}
51
53
***Repository-level breakdown:** Identify which repositories have the highest number of critical or exploitable vulnerabilities.
52
54
***Remediation tracking:** Track the number and percentage of alerts fixed over time to measure the effectiveness of your vulnerability management program.
53
55
54
-
### 2. Monitor introduction of new {% data variables.product.prodname_code_scanning %} alerts
56
+
### Monitor introduction of new {% data variables.product.prodname_code_scanning %} alerts
55
57
56
58
Use the alert view for {% data variables.product.prodname_code_scanning %} to gain visibility into remediation activity in your organization's pull requests. See [AUTOTITLE](/code-security/security-overview/viewing-metrics-for-pull-request-alerts).
57
59
@@ -60,7 +62,7 @@ Use the alert view for {% data variables.product.prodname_code_scanning %} to ga
60
62
***Repository-level breakdown:** Identify which repositories have the highest number of alerts detected in pull requests but still merged into the default branch.
61
63
***Remediation tracking:** Track the number and percentage of alerts fixed over time to measure the effectiveness of your vulnerability management program.
62
64
63
-
### 3. Prioritize remediation efforts
65
+
### Prioritize remediation efforts
64
66
65
67
Focus on vulnerabilities that present the highest risk to your organization.
66
68
@@ -69,20 +71,20 @@ Focus on vulnerabilities that present the highest risk to your organization.
69
71
* Encourage development teams to address vulnerabilities that are actually used in deployed artifacts through repository custom properties and using production context. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-vulnerabilities/alerts-in-production-code).{% endif %}{% ifversion security-campaigns %}
70
72
* Create security campaigns to encourage and track the remediation of high priority {% data variables.product.prodname_code_scanning %} alerts. See [AUTOTITLE](/code-security/securing-your-organization/fixing-security-alerts-at-scale/creating-managing-security-campaigns).{% endif %}
71
73
72
-
### 4. Communicate risk and progress
74
+
### Communicate risk and progress
73
75
74
76
* Use the metrics pages to communicate key risk factors and remediation progress to stakeholders.
75
77
* Provide regular updates on trends, such as the reduction in open critical vulnerabilities or improvements in remediation rates.
76
78
* Highlight repositories or teams that require additional support or attention.
77
79
78
-
### 5. Establish and enforce policies
80
+
### Establish and enforce policies
79
81
80
82
* Set an organization-wide security configuration that enables {% data variables.product.prodname_dependabot %} and {% data variables.product.prodname_code_scanning %} on all existing and new repositories. See [AUTOTITLE](/code-security/securing-your-organization/introduction-to-securing-your-organization-at-scale/about-enabling-security-features-at-scale).
81
83
* Enable dependency review to comment on pull requests in all repositories.
82
84
* Create an organization-wide ruleset to protect the default branch and require critical {% data variables.product.prodname_code_scanning %} alerts to be fixed before a pull request can be merged. See [AUTOTITLE](/organizations/managing-organization-settings/managing-rulesets-for-repositories-in-your-organization).
83
85
* Work with repository administrators to enable automated security updates where possible. See [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates).
84
86
85
-
### 6. Assess the impact of alerts
87
+
### Assess the impact of alerts
86
88
87
89
* Regularly review how {% data variables.product.prodname_dependabot %} and {% data variables.product.prodname_code_scanning %} alerts are helping to block security vulnerabilities from entering your codebase.
88
90
* Use historical data to demonstrate the value of proactive dependency management.
Copy file name to clipboardExpand all lines: content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/tracking-security-campaigns.md
+11-5Lines changed: 11 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Tracking security campaigns
3
3
shortTitle: Track security campaign
4
-
intro: You can monitor the progress of all your organization's security campaigns, and track the status of individual campaigns.
4
+
intro: Use the campaign tracking views to monitor remediation progress, identify stalled work, and measure campaign impact across your organization.
5
5
allowTitleToDifferFromFilename: true
6
6
permissions: '{% data reusables.permissions.security-org-enable %}'
7
7
product: '{% data reusables.gated-features.security-campaigns %}'
@@ -23,9 +23,9 @@ redirect_from:
23
23
24
24
## Tracking campaigns across your organization
25
25
26
-
The tracking view provides an overview of data for all open and closed campaigns. It helps you understand the impact of the campaigns, track progress through campaigns and measure success towards achieving your organization's goals.
26
+
The tracking view helps you quickly assess the health of your organization’s campaigns. You can use it to identify campaigns with a high number of open alerts, check whether work has started, and determine whether campaigns are on track to meet their due dates.
27
27
28
-
To display the campaign tracking view, navigate to the **Security** tab for the organization, then in the left sidebar click **{% octicon "goal" aria-hidden="true" aria-label="goal" %} Campaigns**. {% ifversion security-campaigns-secrets %}To display campaigns for secrets, click the **Secrets**at at the top of the page.
28
+
To display the campaign tracking view, navigate to the **Security** tab for the organization, then in the left sidebar click **{% octicon "goal" aria-hidden="true" aria-label="goal" %} Campaigns**. {% ifversion security-campaigns-secrets %}To display campaigns for secrets, click the **Secrets**tab at the top of the page.
29
29
30
30
31
31
@@ -42,6 +42,8 @@ The tracking view shows you a summary of "Open" and "Closed" campaigns, with the
42
42
***Fixed**: the alert has been resolved, either within or outside of the campaign workflow.
43
43
***Dismissed**: the alert was reviewed but intentionally not fixed; it has been dismissed.
44
44
45
+
Review the proportion of alerts in each status to understand where action is needed. A high number of **Open** alerts may indicate that remediation has not yet started, while a low number of **In progress** alerts could signal that teams need additional guidance or prioritization.
46
+
45
47
## Tracking a single campaign
46
48
47
49
You can similarly track how a single campaign is progressing by viewing the campaign's own tracking page.
@@ -50,13 +52,17 @@ To display the tracking page for a campaign, navigate to the "Campaigns" page, {
50
52
51
53
52
54
53
-
The tracking view shows you a summary of:
55
+
The tracking view for a single campaign helps you evaluate whether remediation is progressing as expected and whether additional follow-up is required.
56
+
57
+
The following indicators help you evaluate whether remediation is progressing as expected and whether additional follow-up is required.
54
58
55
59
***Campaign progress**: how many alerts are closed (fixed or dismissed), in progress, or still left to review.
56
60
***Status**: how the campaign is progressing towards its due date.
57
61
***{% data variables.copilot.copilot_autofix_short %}** (code campaigns only): number of alerts where {% data variables.copilot.copilot_autofix_short %} can generate a fix to resolve the alert.
58
62
59
-
You can also explore the campaign repositories and alerts to see where teams are engaging in the campaign, and where teams might need some extra encouragement to take part.
63
+
For example, if many alerts remain open as the due date approaches, you may need to follow up with repository owners or adjust the campaign timeline.
64
+
65
+
You can also explore campaign repositories and alerts to identify which teams are actively addressing alerts and which may need follow-up.
60
66
61
67
***Repository details:** you can expand any repository to show the progress in alert remediation.
62
68
***Alert details:** you can set the "Group by" option to **None** to show a list of all alerts.
Copy file name to clipboardExpand all lines: content/copilot/how-tos/copilot-cli/cli-best-practices.md
+8Lines changed: 8 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -484,6 +484,14 @@ To submit private feedback to {% data variables.product.github %} about {% data
484
484
## Hands-on practice
485
485
Try the [Creating applications with {% data variables.copilot.copilot_cli_short %}](https://github.com/skills/create-applications-with-the-copilot-cli) Skills exercise for practical experience building an application with {% data variables.copilot.copilot_cli_short %}.
486
486
487
+
Here is what you will learn:
488
+
* Install {% data variables.copilot.copilot_cli_short %}
**Short version:**_We host a wide variety of collaborative projects from all over the world, and that collaboration only works when our users are able to work together in good faith. While using the Service, you must comply with our Acceptable Use Policies, which include some restrictions on content and conduct on GitHub related to user safety, intellectual property, privacy, authenticity, and other limitations. In short, be excellent to each other._
0 commit comments