Best practices to keep your projects secure on GitHub
1–10 of 35 posts
Re: Best practices to keep your projects secure on GitHub
#2Article is all about dependencies. And it only mentions JavaScript. So maybe a better topic would be: "How to use GitHub dependency tool to secure your Javascript project"
Re: Best practices to keep your projects secure on GitHub
#3Article is all about dependencies. And it only mentions JavaScript. So maybe a better topic would be: "How to use GitHub dependency tool to secure your Javascript project"
It looks like they support other package ecosystems as well:
https://docs.github.com/en/code-security/supply-chain-securi...
That said, the article does indeed seem to focus entirely on dependencies.
Re: Best practices to keep your projects secure on GitHub
#4Article doesn't talk about much, just a bit on dependencies apparently from someone focused on supply chain security at Github.
At previous role, the more we looked at some of the technical controls around security within github itself, and had a number of security concerns. There's alot of nuance which is hard to go through and comment on, but the defaults and controls caused us lots of concern.
Here's a good writeup for anyone interested: https://cycode.com/blog/github-actions-vulnerabilities/
Re: Best practices to keep your projects secure on GitHub
#5On the topic of security, I am surprised there aren’t more safeguards for marketplace actions. I work in a larger organization and see that folks very much want to pull in actions that solve an immediate need without any type of vetting process. These actions are part of your build pipeline and can pose a substantial security threat.
Dependabot does not currently scan for outdated or vulnerable marketplace actions. It’s difficult for Enterprise Orgs to ensure only vetted actions are used. I think this area of GitHub is ripe for security and governance improvements.
Re: Best practices to keep your projects secure on GitHub
#6Article is all about dependencies. And it only mentions JavaScript. So maybe a better topic would be: "How to use GitHub dependency tool to secure your Javascript project"
I’ve noticed Dependabot isn’t always even the greatest for JS projects. There are popular front-end frameworks such as Angular or React. When it makes PRs for currency updates, it seems unaware that it should
update all packages for a particular framework or update @types imports when it updates a package import.
Re: Best practices to keep your projects secure on GitHub
#7...don't let them be scanned by HackerRank folks.
Re: Best practices to keep your projects secure on GitHub
#8From what I can tell, there appears to be two camps.
1) Do not update dependencies (because updating to the latest version just because is silly) 2) Update dependencies (because security)
Personally, I fall into the second group (with caveats). I've found that Dependabot helps with the tedious work of updating versions by hand but at the same time provides a check so that I manually approve. This seems to work out to be a decent balance. I've also moved away from using :latest or @v2 etc. and switched to using commit hashes/image digests. Once again, Dependabot is helpful for tracking changes/updates once you switch over.
The one annoying thing is that Dependabot does not always trigger on a regular basis (once a day) but I've found that bumping .github/dependabot.yml reliably triggers it.
Re: Best practices to keep your projects secure on GitHub
#9From what I can tell, there appears to be two camps. 1) Do not update dependencies (because updating to the latest version just because is silly) 2) Update dependencies (because security) Personally, I fall into the second group (with caveats). I've found that Dependabot helps with the tedious work of updating versions by hand but at the same time provides a check so that I manually approve. This seems to work out to…
> Do not update dependencies (because updating to the latest version just because is silly)
That's quite the straw man; I seriously doubt that anybody is saying you shouldn't update because it's "silly". Blindly pulling updates is how you get compromised by supply chain attacks.
Re: Best practices to keep your projects secure on GitHub
#10On the topic of security, I am surprised there aren’t more safeguards for marketplace actions. I work in a larger organization and see that folks very much want to pull in actions that solve an immediate need without any type of vetting process. These actions are part of your build pipeline and can pose a substantial security threat. Dependabot does not currently scan for outdated or vulnerable marketplace actions. I…
So if you are concerned about this, I'd suggest looking at the following:
* OpenSSF Scorecard Action - https://github.com/ossf/scorecard#scorecards-github-action
* Step Security Harden Action - https://github.com/step-security/harden-runner
I realize that this means trusting these providers but they seem at least tacitly blessed by GitHub. https://docs.github.com/en/actions/security-guides/security-...