GitHub Advanced Security Reviews

I use GitHub Advanced Security for source code analysis and code scanning. It is integrated within my development environment and is beneficial for organizations where all development is within GitHub.

GitHub Advanced Security is a very developer-friendly solution that is integrated within my development environment. This integration allows me to work seamlessly without leaving my workflow, which is beneficial for organizations using GitHub. However, it is less useful for organizations with diversified development environments. The product is scalable.

I use it for Azure DevOps, for example. This tool focuses on the security of the code. It performs code analysis to identify security issues, such as hard-coded secrets and passwords, potential SQL injection points, and duplicated components.

SonarQube, on the other hand, focuses more on overall code quality and best practices, using a different approach that often results in more findings for the developer to handle. 

GitHub Advanced Security uses artificial intelligence in the backend, specifically CodeQL, to analyze code and provide fewer but more reliable findings, so there are less false positives. This allows developers to concentrate on the most relevant issues.

Both tools have their uses, with GitHub Advanced Security being purely security-focused and SonarQube concentrating on code quality. Many software companies use both tools for comprehensive code analysis. Somehow, they complement each other. 

We also use the secret scanning feature of GitHub. 

It finds hardcoded secrets directly in the code and points them out immediately. Then, I can go back to the developers and let them know. 

I can even block the commit in the repository so they cannot commit until they fix the issue.

AI in the backend:

CodeQL uses AI algorithms, so it reduces false positives. For example, in a SQL injection, it finds the user input flow of the code instead of looking for hardcoded SQL statements. It looks at where parameters can be created and filled with data. If it ends on a path where it comes from a user, then you really get an SQL injection. If it's just a parameter populated through something else, there is no danger. 

This is one difference between SonarQube and GitHub Advanced Security. It gives you fewer false positives, so you don't waste time figuring out if it's a real security issue or a false alarm.

I use the solution in my company to develop web applications and mobile apps. In my company, we use GitHub Advanced Security to check the vulnerabilities in the codes.

The deployment part of the product is an area of concern that needs to be made easier from an improvement perspective.

In my company, the actual implementation phase takes time, though the tool is able to give us reports. It is not easy for our company's teams to understand what changes are to be made to the product. If there are some guidelines on how to make the changes in GitHub Advanced Security and how to address the vulnerabilities, then it would be a better tool.

In general, the implementation part of the product is an area of concern where improvements are required.

The main focus of our use case is to enhance the overall security mindset and to improve the developer experience. Prioritizing security, our primary objective is to ensure the accuracy of security findings, minimize noise, and optimize the identification of potential vulnerabilities.

The most valuable is the developer experience and the extensibility of the overall ecosystem. When I refer to extensibility, I mean the ability to incorporate custom queries using CodeQL, the engine powering GitHub Advanced Security. This customization allows for creating specific queries tailored to our domain, beyond the general rule set.

My company is a partner. We help in product implementation for SaaS analytics. The solution is used for SaaS scans and secret scanning.

Dependency scanning is a valuable feature. The dependency review feature can be run as part of the CI pipeline. Secret scanning and push protection can block threats. It discovers the vulnerabilities. It helps identify the threats that are commonly seen in the industry.

CodeQL provides ease of use. It enables a high degree of customization. We can write our own queries and configure them in bulk for different projects. The tool provides APIs if we want to integrate it with any external system.

The primary use case for GitHub Advanced Security is for SCSS (Semantic Code Search and Scan) dependencies scan and secret scan.

The most valuable features are security scan, dependency scan, and cost-effectiveness. Microsoft owns the platform, and it is included with Azure DevOps. We get a lot of good features at a very low cost.

We keep our firewall security in place. Customers use GitHub because they don't want to coordinate with many tools. 

GitHub provides advanced security, which is why the customers choose this tool; it allows them to rely solely on GitHub as one platform for everything they need.

For customers, GitHub Advanced Security is valuable for several reasons. It offers server security and the key features. 

We use GitHub Advanced Security to secure data for multiple applications. It ensures user passwords or sensitive information are not accidentally exposed in code or reports. It scans the project's dependencies and checks if they are up-to-date and free from known security vulnerabilities.

GitHub Advanced Security is part of the Azure DevOps ecosystem. So, all the dashboards and information stay in our environment. We are not required to integrate it with any external security solution.