Workshop Labs Resources

• Who is this for: Enterprise - Engineering Leadership, Enterprise - Developers, Open Source Developers or Maintainers, Security Professionals, Startups, Security Leadership, Educators
• What you'll learn: Here at GitHub, we like to say that "found means fixed." That's because when issues are found they can more easily be fixed. In this workshop you'll dive into a repository filled with security alerts and begin to remediate them using GitHub Advanced Security (GHAS) and Dependabot, effectively maintaining code integrity. You'll also encounter and resolve a few security issues using Copilot Autofix. The end goal? To learn and develop strategies to motivate your developers to turn reactive fixes into proactive security habits.

See requirements to see what is needed to run this lab.

This lab will introduce you to GitHub Advanced Security (GHAS) and its features.

• Get started here - Lab 1

This lab will show you how to review and managed the alerts created in Lab 1.

• Get started here - Lab 2

This lab will have you add some bad code, utilize repository rulesets to block the code, and Copilot Autofix to fix the code.

• Get started here - Lab 3

This lab will have you utilize the Dependency Review action to stop a bad vulnerability in a pull request.

• Get started here - Lab 4

This lab will have you utilize Secret Scanning with Push Protection to prevent secrets from entering the codebase.

• Get started here - Lab 5

This lab will teach you how to effectively use the Security Overview to review and alerts and coverage in an organization.

• Get started here - Lab 6

This open-ended extra credit lab will have you switch to the advanced CodeQL setup.

• Get started here - Extra Credit Lab 1

This open-ended extra credit lab will have you create a custom secret scanning pattern.

• Get started here - Extra Credit Lab 2

• GitHub Docs - About GitHub Advanced Security
• GitHub Security Learning Pathway

This project is licensed under the terms of the MIT open source license. Please refer to MIT for the full terms.

This lab uses and includes sample code from the OWASP Juice Shop project. The Juice Shop is Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors. Please refer to the LICENSE for the full terms.