Code security guides
Learn about the different ways that GitHub can help you improve your code's security.
Fix and disclose a security vulnerability
Using repository security advisories to privately fix a reported vulnerability and get a CVE.Start learning path- 1Overview
About coordinated disclosure of security vulnerabilities
Vulnerability disclosure is a coordinated effort between security reporters and repository maintainers. - 2How-to guide
Creating a repository security advisory
You can create a draft security advisory to privately discuss and fix a security vulnerability in your open source project. - 3How-to guide
Adding a collaborator to a repository security advisory
You can add other users or teams to collaborate on a security advisory with you. - 4How-to guide
Collaborating in a temporary private fork to resolve a repository security vulnerability
You can create a temporary private fork to privately collaborate on fixing a security vulnerability in your repository. - 5How-to guide
Publishing a repository security advisory
You can publish a security advisory to alert your community about a security vulnerability in your project. - 6How-to guide
Editing a repository security advisory
You can edit the metadata and description for a repository security advisory if you need to update details or correct errors. - 7How-to guide
Withdrawing a repository security advisory
You can withdraw a repository security advisory that you've published. - 8How-to guide
Removing a collaborator from a repository security advisory
When you remove a collaborator from a repository security advisory, they lose read and write access to the security advisory's discussion and metadata.
Code security learning paths
Learning paths are a collection of guides that help you master a particular subject.
Get notifications for vulnerable dependencies
Set up Dependabot to alert you to new vulnerabilities in your dependencies.
Get pull requests to update your vulnerable dependencies
Set up Dependabot to create pull requests when new vulnerabilities are reported.
Keep your dependencies up-to-date
Use Dependabot to check for new releases and create pull requests to update your dependencies.
Run code scanning with GitHub Actions
Check your default branch and every pull request to keep vulnerabilities and errors out of your repository.
Run CodeQL code scanning in your CI
Set up CodeQL within your existing CI and upload results to GitHub code scanning.
Integrate with code scanning
Upload code analysis results from third-party systems to GitHub using SARIF.
End-to-end supply chain
How to think about securing your user accounts, your code, and your build process.