About security findings
After you apply a security configuration to a repository, the enabled security features will likely raise security findings on that repository. These findings may show up as feature-specific alerts, or as automatically generated pull requests designed to keep your repository secure. To best secure your organization, you should encourage contributors to those repositories to review and resolve these alerts and pull requests. You can analyze the findings across the organization and make any necessary adjustments to your security configuration.
Interpreting secret scanning alerts
Secret scanning은(는) 리포지토리의 전체 Git 기록뿐만 아니라 해당 리포지토리의 이슈, 끌어오기 요청 및 토론에서 토큰이나 프라이빗 키와 같이 실수로 유출된 비밀이 있는지 스캔하는 보안 도구입니다. There are two types of secret scanning alerts:
- 파트너에 대한 비밀 검사 경고, which are sent to the provider who issued the secret
- 사용자에 대한 비밀 검사 경고, which appear on GitHub and can be resolved
You can view secret scanning alerts for an organization by navigating to the main page of that organization, clicking the Security tab, then clicking Secret scanning.
For an introduction to secret scanning alerts, see "비밀 검사 경고 정보."
To learn how to evaluate secret scanning alerts, see "비밀 검사에서 경고 평가."
Interpreting code scanning alerts
Code scanning는 GitHub 리포지토리의 코드를 분석하여 보안 취약성 및 코딩 오류를 찾는 데 사용하는 기능입니다. 분석으로 식별되는 모든 문제는 리포지토리에 표시됩니다. These problems are raised as code scanning alerts, which contain detailed information on the vulnerability or error detected.
You can view the code scanning alerts for an organization by navigating to the main page of that organization, clicking the Security tab, then clicking Code scanning.
For an introduction to code scanning alerts, see "코드 검사 경고 정보."
To learn how to interpret and resolve code scanning alerts, see "Assessing code scanning alerts for your repository" and "Resolving code scanning alerts."
Interpreting Dependabot alerts
Dependabot alerts inform you about vulnerabilities in the dependencies that you use in repositories in your organization. You can view Dependabot alerts for an organization by navigating to the main page of that organization, clicking the Security tab, then clicking Dependabot.
For an introduction to Dependabot alerts, see "Dependabot 경고 정보."
To learn how to interpret and resolve Dependabot alerts, see "Dependabot 경고 보기 및 업데이트."
Note: If you enabled Dependabot security updates, Dependabot can also automatically raise pull requests to update the dependencies used in the repositories of the organization. For more information, see "Dependabot 보안 업데이트 정보."
Next steps
If you are using the GitHub-recommended security configuration, and your findings indicate the security enablement settings are not meeting your needs, you should create a custom security configuration. To get started, see "사용자 지정 보안 구성 만들기."
If you are using a custom security configuration, and your findings indicate the security enablement settings are not meeting your needs, you can edit your existing configuration. For more information, see "사용자 지정 보안 구성 편집."
Lastly, you can also edit your organization-level security settings with global settings. To learn more, see "조직에 대한 글로벌 보안 설정 구성."