GH-500 GitHub Advanced Security Roadmap

Begin with the architecture. Learn which suite protects which risk, how public and private repository availability differs, and why prevention, detection, remediation, and governance must work together.

• Contrast GitHub Code Security, GitHub Secret Protection, and supply chain security capabilities
• Verify current availability for public, private, internal, organization-owned, and enterprise repositories
• Navigate repository, organization, and enterprise Security and quality views
• Use security overview Coverage, Risk, Overview, Enablement, CodeQL pull-request, Dependabot, and secret views
• Explain why no visible alerts does not prove that a repository is secure
• Map developer, security, repository-admin, security-manager, organization-owner, and enterprise-owner responsibilities
• Compare prevention-first controls with post-detection gates and campaign-based remediation
• Understand alert access, assignment, notification, dismissal, bypass, and audit consequences
• Build a risk-tiered repository inventory before planning feature rollout

Practice secrets as an incident and prevention workflow. Never expose a live credential for training; use a clearly invalid custom-pattern marker in a disposable repository.

• Enable Secret Protection at repository and organization scope where eligible
• Explain public monitoring, provider patterns, generic patterns, custom patterns, and AI-detected secrets at the appropriate level
• Know user, push-protection, and partner alert differences
• Use validity checks to prioritize supported active credentials with awareness of provider contact
• Respond to a real leak by revoking or rotating first, then investigating and cleaning code or history
• Enable repository push protection and distinguish it from user push protection
• Understand bypass reasons and resulting open or closed alert states
• Configure delegated bypass reviewers and distinguish bypass privilege from full exemption
• Test custom patterns with synthetic positive and negative values before enforcement
• Configure alert recipients, exclusions, filters, ownership, and evidence-backed dismissal

Secure both the dependencies already on the default branch and the changes proposed in pull requests. Treat complete inventory as the prerequisite for meaningful detection.

• Build the dependency graph from supported manifests, lock files, and dependency submissions
• Inspect direct and transitive paths, versions, licenses, manifests, and known vulnerabilities
• Export and interpret an SPDX software bill of materials and remember that it excludes dependents
• Distinguish Dependabot alerts, security updates, and scheduled version updates
• Prioritize alerts using severity, EPSS or exploitation context, usage, path, fix availability, and asset criticality
• Configure dependabot.yml version 2 with ecosystems, directories, schedules, groups, limits, labels, and registry access
• Use auto-triage rules only for documented risk criteria and review their outcomes
• Review dependency changes, vulnerabilities, release context, and licenses in pull requests
• Configure the dependency review action and require it through rulesets or branch checks
• Sequence dependency submission before dependency review or use documented snapshot-warning retry behavior

Learn how CodeQL turns code into data, how setups differ, and how an alert moves from source-to-sink evidence through a tested remediation.

• Choose between CodeQL default setup, advanced GitHub Actions setup, and external CI
• Know supported CodeQL languages and avoid assuming unsupported languages are analyzed
• Configure pull-request, push, and scheduled scan frequency based on repository risk and cost
• Use matrices and correct build modes for compiled and interpreted language analysis
• Apply minimum workflow permissions and troubleshoot build, database, runner, memory, timeout, and upload failures
• Interpret alert severity, security severity, first introduction, affected branches, categories, and multiple configurations
• Trace CodeQL source-to-sink data flow and group related paths during triage
• Upload third-party SARIF with unique categories or runAutomationDetails identities
• Review Copilot Autofix as a proposed change that still requires human review and tests
• Create tested custom queries, models, suites, and versioned query packs for organization-specific risk

Finish at scale. Convert scanner output into accountable risk reduction, apply consistent configurations, preserve defensible evidence, and verify automated rollout rather than trusting a script exit code.

• Relate CVEs, CWEs, GitHub Security Advisories, CVSS, EPSS, reachability, and business exposure
• Define severity and remediation service levels, ownership, escalation, and exception expiry
• Create focused security campaigns with a due date, contact, assignments, and validated completion goal
• Verify current preview status and behavior before relying on secret scanning campaigns
• Document alert dismissals with evidence, reason, reviewer, date, and reassessment trigger
• Track coverage, detection, backlog, remediation time, prevention, bypasses, exceptions, and campaign progress together
• Use stable filters and audit logs when historical compliance evidence must remain consistent
• Create and pilot security configurations with enforcement, inheritance, and custom exceptions
• Use security managers, delegated controls, least-privilege GitHub Apps, and separated administration duties
• Automate with dry runs, pagination, rate-limit handling, idempotency, structured errors, and observed-state reconciliation
• Complete both synthetic projects, review all official objectives, and explain distractors rather than memorizing letters