r/github • u/Choice_Pickle4293 • 3d ago

Question How does your company use GitHub Advanced Security?

I work with GitHub. If your company used GitHub Advanced Security. I have a few questions about it.

Questions:
1. How do you use the features?
2. How’s the User Experience?
3. Can you share a situation where it helped the team?
4. Are you using any tools alongside GitHub Advanced Security?
5. What’s the most frustrating part?

0 Upvotes

17% Upvoted

5 comments sorted by

1

u/DiligentlyElaborate 3d ago

We’re a small team so we mostly lean on the secret scanning alerts and the code scanning for PRs, just kinda runs in the background. The UX is fine I guess, nothing flashy but it stays out of the way most of the time

Helped us catch an API key that almost got pushed to prod once, dev had it in a config file they forgot to gitignore, alert popped up before merge and saved a whole weekend fire drill

Biggest frustration is the noise, sometimes the same dependency alert fires for three repos and you gotta dismiss them one by one, feels like busywork

1

u/Choice_Pickle4293 3d ago

Got it. GitHub copilot autofix is out now. Please check it out. That should help. But you gotta assign the fix to copilot.

1

u/zomerbk 3d ago

One practical wrinkle is alert ownership. Code scanning and secret scanning are most useful when findings land with the team that can fix them; otherwise they can turn into a noisy backlog. Do you use push protection and branch protection to prevent issues from merging, or mainly review alerts after they appear?

1

u/Choice_Pickle4293 3d ago

We have push protection and branch protection enabled. We have code-QL workflow that works when pushing on every branch. That catches the alert pretty early. It does consume some action minutes but we use Github branching strategy too.

Now,
Github copilot autofix has launched so we can select upto 25 alerts and fix them. Copilot will raise a draft PR.