Code security guides
Learn about the different ways that GitHub can help you improve your code's security.
Fix and disclose a security vulnerability
Using repository security advisories to privately fix a reported vulnerability and get a CVE.Start learning path- 1Overview
关于安全漏洞的协调披露
漏洞披露是安全报告者与仓库维护者之间的协调工作。 - 2Overview
关于 GitHub 公告数据库
GitHub Advisory Database 包含已知安全漏洞和恶意软件的列表，分为两类：经 GitHub 审核的公告和未经审核的公告。 - 3Overview
关于全局安全公告
全局安全公告位于 GitHub Advisory Database，它是影响开源环境的 CVE 和 GitHub 发起的公告集合。 你可以为改进全局安全公告做出贡献。 - 4Overview
关于存储库安全公告
可以使用存储库安全公告来私下讨论、修复和发布有关存储库中安全漏洞的信息。 - 5How-to guide
Best practices for writing repository security advisories
When you create or edit security advisories, the information you provide is easier for other users to understand when you specify the ecosystem, package name, and affected versions using the standard formats. - 6How-to guide
私下报告安全漏洞
某些公共存储库配置安全公告，以便任何人都可以直接并私下向维护人员报告安全漏洞。 - 7How-to guide
管理私下报告的安全漏洞
存储库维护人员可以管理由存储库安全研究人员向其私下报告的安全漏洞，这些存储库已启用了非公开漏洞报告。 - 8How-to guide
Configuring private vulnerability reporting for a repository
Owners and administrators of public repositories can allow security researchers to report vulnerabilities securely in the repository by enabling private vulnerability reporting. - 9How-to guide
Configuring private vulnerability reporting for an organization
Organization owners and security managers can allow security researchers to report vulnerabilities securely in repositories within the organization by enabling private vulnerability reporting for all its public repositories. - 10How-to guide
创建存储库安全公告
您可以创建安全通告草稿，以私下讨论和修复开源项目中的安全漏洞。 - 11How-to guide
Adding a collaborator to a repository security advisory
You can add other users or teams to collaborate on a security advisory with you. - 12How-to guide
在临时专用分支中协作以解决存储库安全漏洞
您可以创建临时私有复刻，以私下协作修复仓库中的安全漏洞。 - 13How-to guide
Publishing a repository security advisory
You can publish a security advisory to alert your community about a security vulnerability in your project. - 14How-to guide
编辑存储库安全通告
如果需要更新详细信息或更正错误，可以编辑存储库安全公告的元数据和说明。 - 15How-to guide
撤销存储库安全通告
你可以撤销已发布的存储库安全公告。 - 16How-to guide
删除存储库安全公告中的协作者
协作者从存储库安全公告中删除后，将失去对安全公告的讨论和元数据的读取和写入权限。
Code security learning paths
Get notifications for insecure dependencies
Set up Dependabot to alert you to new vulnerabilities or malware in your dependencies.
Get pull requests to update your vulnerable dependencies
Set up Dependabot to create pull requests when new vulnerabilities are reported.
Keep your dependencies up-to-date
Use Dependabot to check for new releases and create pull requests to update your dependencies.
Scan for secrets
Set up secret scanning to guard against accidental check-ins of tokens, passwords, and other secrets to your repository.
Run code scanning with GitHub Actions
Check your default branch and every pull request to keep vulnerabilities and errors out of your repository.
Run CodeQL code scanning in your CI
Set up CodeQL within your existing CI and upload results to GitHub code scanning.
Integrate with code scanning
Upload code analysis results from third-party systems to GitHub using SARIF.
End-to-end supply chain
How to think about securing your user accounts, your code, and your build process.
All Code security guides
Adding a security policy to your repository
How-to guideYou can give instructions for how to report a security vulnerability in your project by adding a security policy to your repository.
- Security policies
- Vulnerabilities
- Repositories
- Health
GitHub 安全功能
OverviewGitHub 安全功能概述。
- Repositories
- Dependencies
- Vulnerabilities
- Advanced Security
保护你的组织
How-to guide您可以使用许多 GitHub 功能来帮助保护组织的安全。
- Organizations
- Dependencies
- Vulnerabilities
- Advanced Security
保护您的仓库
How-to guide您可以使用许多 GitHub 功能来帮助保护仓库的安全。
- Repositories
- Dependencies
- Vulnerabilities
- Advanced Security
About secret scanning
OverviewGitHub scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally.
- Secret scanning
- Advanced Security
为存储库配置机密扫描
How-to guide可以配置 GitHub 如何扫描存储库中遭到泄露的机密并生成警报。
- Secret scanning
- Advanced Security
- Repositories
为机密扫描定义自定义模式
How-to guide你可以扩展 secret scanning 以检测默认模式之外的机密。
- Advanced Security
- Secret scanning
管理来自机密扫描的警报
How-to guide您可以查看并关闭已检入仓库的密码的警报。
- Secret scanning
- Advanced Security
- Alerts
- Repositories
使用机密扫描保护推送
How-to guide可以使用 secret scanning 通过启用推送保护，防止将支持的机密推送到 组织 或存储库中。
- Secret scanning
- Advanced Security
- Alerts
- Repositories