This guide describes the highest impact changes you can make to improve the security of your code. Cada sección detalla un cambio que puedes hacer a tus procesos para mejorar la seguridad. Los cambios de más alto impacto se listan primero.
Key risks in the development process include:
- Using dependencies with security vulnerabilities that an attacker could exploit.
- Leaking authentication credentials or a token that an attacker could use to access your resources.
- Introducing a vulnerability to your own code that an attacker could exploit.
These risks open your resources and projects to attack and those risks are passed directly on to anyone who uses a package that you create. The following sections explain how you can protect yourself and your users from these risks.
You can secure the code you depend on by creating a vulnerability management program for dependencies. At a high level this should include processes to ensure that you:
Create an inventory of your dependencies.
Know when there is a security vulnerability in a dependency.
Assess the impact of that vulnerability on your code and decide what action to take.
As a first step, you want to make a complete inventory of your dependencies. The dependency graph for a repository shows you dependencies for supported ecosystems. If you check in your dependencies, or use other ecosystems, you will need to supplement this with data from 3rd party tools or by listing dependencies manually. Para obtener más información, consulta la sección "Acerca de la gráfica de dependencias".
Dependabot can help you by monitoring your dependencies and notifying you when they contain a known vulnerability. For more information, see "About Las alertas del dependabot".
When you discover you are using a vulnerable dependency, for example, a library or a framework, you must assess your project's level of exposure and determine what action to take. Vulnerabilities are usually reported with a severity score to show how severe their impact could be. The severity score is a useful guide but cannot tell you the full impact of the vulnerability on your code.
To assess the impact of a vulnerability on your code, you also need to consider how you use the library and determine how much risk that actually poses to your system. Maybe the vulnerability is part of a feature that you don't use, and you can update the affected library and continue with your normal release cycle. Or maybe your code is badly exposed to risk, and you need to update the affected library and ship an updated build right away. This decision depends on how you're using the library in your system, and is a decision that only you have the knowledge to make.
Code often needs to communicate with other systems over a network, and requires secrets (like a password, or an API key) to authenticate. Your system needs access to those secrets to run, but it's best practice to not include them in your source code. This is especially important for public repositories, but also for private repositories to which many people might have access.
Nota: El Escaneo de secretos se encuentra disponible para los repositorios que pertenecen a organizaciones de GitHub Enterprise Server si tu empresa tiene una licencia de GitHub Advanced Security. Para obtener más información, consulta la sección "Productos de GitHub".
Nota: Tu administrador de sitio debe habilitar el escaneo de secretos para tu instancia de GitHub Enterprise Server antes de que puedas utilizar esta característica. Para obtener más información, consulta "Configurar el escaneo de secretos en tu aplicativo."
You can configure escaneo de secretos to check for secrets issued by many service providers and to notify you when any are detected. También puedes definir patrones personalizados para detectar secretos adicionales a nivel de repositorio, organización o empresa. For more information, see "About secret scanning" and "Secret scanning patterns."
Nota: El Escaneo de código se encuentra disponible para los repositorios que pertenecen a organizaciones donde se habilitó el GitHub Advanced Security. Para obtener más información, consulta la sección "Acerca de GitHub Advanced Security".
Nota: Tu administrador de sitio debe habilitar el escaneo de código para tu instancia de GitHub Enterprise Server antes de que puedas utilizar esta característica. Para obtener más información, consulta "Configurar el escaneo de código en tu aplicativo."
You can improve the quality and security of your code by ensuring that all pull requests are reviewed and tested before they are merged. GitHub has many features you can use to control the review and merge process. To get started, see "About protected branches."
Insecure code patterns are often difficult for reviewers to spot unaided. In addition to scanning your code for secrets, you can check it for patterns that are associated with security vulnerabilities. For example, a function that isn't memory-safe, or failing to escaping user input that could lead to an injection vulnerability. GitHub offers several different ways to approach both how and when you scan your code. To get started, see "About code scanning."