GitHub Advanced Security flashcards
GitHub Advanced Security · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- GHAS feature bundle
- GitHub Advanced Security bundles code scanning with CodeQL, secret scanning with push protection, and Dependabot with dependency review; it is a paid add-on for private repositories on GitHub Enterprise.
- CodeQL database
- A CodeQL database is a compiled representation of a codebase that queries run against; creating it requires a build for compiled languages and no build for interpreted languages.
- Push protection
- Push protection blocks a git push containing a detected secret before it reaches the repository; users with bypass permission can override it by supplying a recorded reason.
- Dependency review action
- The dependency review action runs on pull requests, compares dependency changes, and fails the check when a new dependency has a vulnerability at or above the configured severity threshold.
- Default setup
- Code scanning default setup is configured in repository settings and generates a managed workflow covering supported languages; it cannot use custom query packs or third-party SARIF.
- SARIF upload
- Third-party results are uploaded as SARIF 2.1.0 through github/codeql-action/upload-sarif, requiring security-events write permission and a unique category per tool.
- CodeQL query suite
- A query suite selects which queries run; default targets low false positives, security-extended adds lower-precision security queries, and security-and-quality adds maintainability queries.
- Custom secret pattern
- A custom secret pattern is a regular expression defined at organization or enterprise level with a name and secret format, optionally paired with a validation endpoint.
- Security configuration
- A security configuration applies GHAS feature settings across many repositories; enforcement prevents repository admins from overriding the covered settings.
- Security manager role
- The security manager role grants read access to security alerts and settings across an organization without granting full administrative or write access to code.
- Private vulnerability reporting
- Private vulnerability reporting lets external researchers submit vulnerability reports through a repository form, which maintainers triage in the Security tab instead of a public issue.
- Repository security advisory
- A repository security advisory is drafted in the Security tab, receives a GHSA identifier, can be published to the GitHub Advisory Database, and can request a CVE.
- Temporary private fork
- A temporary private fork is created from a security advisory so collaborators can prepare and test a fix privately before coordinated public disclosure.
- Security overview
- Security overview aggregates alert counts and coverage across an organization or enterprise, filterable by repository, team, tool, and severity, and exportable as CSV.
- Security campaigns
- Security campaigns group a chosen set of alerts with a deadline so teams can remediate a backlog; progress is tracked in security overview.
- Dependabot security updates
- Dependabot security updates automatically open pull requests that bump a vulnerable dependency to a patched version; they require Dependabot alerts and an available fix.
- Dependency submission API
- The dependency submission API accepts a snapshot of resolved dependencies with a correlator and commit SHA, adding them to the dependency graph without a supported manifest.
- Code scanning alert instance
- A code scanning alert has one or more instances, each tied to a branch and commit; the most_recent_instance field gives the latest location and message.
- CodeQL path-problem query
- A path-problem query reports data flow from a source to a sink and must declare @kind path-problem, producing a result with a full taint path.
- CodeQL data flow library
- The CodeQL DataFlow library defines source, sink, and configuration classes; isSource and isSink predicates determine which values are tracked as tainted.
- security-severity in SARIF
- The security-severity rule property in SARIF is a numeric score that GitHub maps to Critical, High, Medium, or Low for third-party code scanning results.
- Copilot Autofix
- Copilot Autofix generates a suggested fix diff for a code scanning alert; the developer reviews and commits it, and the suggestion is not applied automatically.
- Secret validity check
- Secret scanning validity queries the partner service to mark a detected secret as active, inactive, or unknown when the partner supports validation.
- Dependabot alert auto-dismissal
- Auto-dismissal rules close matching Dependabot alerts based on severity, package, or scope, retaining a reason and comment for auditability.
- security_events scope
- The security_events permission on a GitHub App or fine-grained token is required to read or write code scanning and secret scanning alerts through the API.
- Code scanning webhook
- The code_scanning_alert webhook event delivers actions such as created, reopened, closed_by_user, and fixed, with the alert object for external automation.
- GHAS per-committer billing
- GHAS licenses are billed per active committer on private and internal repositories where GHAS is enabled; public repository code scanning and secret scanning are free.
- CodeQL CLI local analysis
- The CodeQL CLI creates a database and analyzes it locally, producing SARIF for debugging queries before uploading results to GitHub code scanning.
- Required status check
- A ruleset or branch protection rule can require the code scanning results check to pass before merging, blocking pull requests that introduce new alerts.
- Actions security-events permission
- A workflow must declare permissions: security-events: write to upload SARIF; omitting it is the most common cause of code scanning upload failure.
- Audit log streaming
- Audit log streaming forwards GHAS events such as alert dismissals and push protection bypasses to a SIEM or storage bucket for retention beyond the UI window.
- Alert dismissal reasons
- Code scanning dismissals require a fixed reason such as false positive, won't fix, or used in tests; secret scanning alerts close as resolved, false positive, or used in tests.