GitHub Security: Secrets, Secret Scanning, Dependabot and Code Scanning

Leaked tokens and vulnerable dependencies are among the most common security problems in software projects. In this lesson you will use GitHub’s security features to keep secrets out of code, keep dependencies safe and scan code automatically.

---

🔐 Security on GitHub: The Big Picture

Most security incidents in code repositories come from three sources: leaked secrets, vulnerable dependencies and insecure code. GitHub has a tool for each:

Risk	GitHub feature
Passwords, tokens and keys in code	Secrets for CI, secret scanning and push protection
Vulnerable libraries	Dependabot alerts, security updates and version updates
Insecure code patterns	Code scanning with CodeQL
Reporting vulnerabilities	SECURITY.md and private security advisories

Find them in your repository under Settings, Code security (also called “Advanced Security” or “Code security and analysis”).

---

🗝️ Secrets for GitHub Actions

Never put passwords or tokens in workflow files. Store them as encrypted secrets:

1. Settings, Secrets and variables, Actions, New repository secret.
2. Name it, e.g. TEST_PASSWORD, paste the value, save.

Use it in a workflow:

- name: Run Playwright tests
  run: npx playwright test
  env:
    BASE_URL: ${{ vars.BASE_URL }}
    TEST_PASSWORD: ${{ secrets.TEST_PASSWORD }}

Level	Shared with
Repository secret	All workflows in the repository
Environment secret	Jobs that target a specific environment (e.g. staging), optionally with required reviewers
Organisation secret	Selected repositories in the organisation

Secrets are masked as *** in logs and are not passed to workflows triggered by pull requests from forks. Details in Variables, Secrets and Environments.

---

🕵️ Secret Scanning and Push Protection

Secret scanning detects known token formats (GitHub, AWS, Azure, Slack, Stripe and many more) in the repository and its history and raises alerts. Push protection goes further: it blocks the push when it detects a secret:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Push cannot contain secrets
remote:   —— GitHub Personal Access Token ——
remote:    locations:
remote:      - commit: 9c7e1aa
remote:        path: tests/api.spec.ts:12

Remove the secret from the commit (amend or interactive rebase), move it to an environment variable or secret, and push again.

---

📦 Dependabot

Dependabot alerts

GitHub reads your dependency files (package-lock.json, requirements.txt, pom.xml and others) and alerts you when a dependency has a known vulnerability, with severity and the fixed version. Enable Dependabot alerts in Settings, Code security.

Dependabot security updates

With security updates enabled, Dependabot opens pull requests that upgrade vulnerable dependencies to a safe version. Your CI runs on them like on any PR.

Dependabot version updates

To keep dependencies current (not just secure), add a config file:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      playwright:
        patterns:
          - "@playwright/*"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

Dependabot then opens PRs such as “Bump @playwright/test from 1.x to 1.y”. Your test suite tells you whether the upgrade is safe, which is exactly why reliable automated tests matter.

---

🔬 Code Scanning with CodeQL

Code scanning analyses source code for security vulnerabilities (SQL injection, cross-site scripting, unsafe deserialisation…) and shows results as alerts and as annotations on pull requests.

1. Settings, Code security, Code scanning, Set up, Default.
2. GitHub detects the languages and runs CodeQL on pushes and pull requests to the default branch, plus on a schedule.
3. Use Advanced setup to customise it with a workflow file if needed.

Alerts appear under the Security tab; you can fix, dismiss with a reason, or create an issue.

---

📣 Reporting Vulnerabilities

• Add a SECURITY.md file explaining how to report security issues privately.
• Enable private vulnerability reporting so researchers can report through GitHub without a public issue.
• Maintainers can draft security advisories and request a CVE.

---

✅ Repository Security Checklist

• [ ] Two-factor authentication for all members (account setup)
• [ ] No secrets in code; .env in .gitignore; CI secrets in GitHub Secrets
• [ ] Secret scanning and push protection on
• [ ] Dependabot alerts, security updates and a dependabot.yml
• [ ] Code scanning with CodeQL
• [ ] Branch protection with required reviews and checks
• [ ] Workflow permissions: set to the minimum needed
• [ ] SECURITY.md and private vulnerability reporting

---

📝 Assignment

1. In a public practice repository, enable Dependabot alerts, security updates, secret scanning and push protection.
2. Add a dependabot.yml for npm (or pip) and GitHub Actions, and look at the first Dependabot PRs.
3. Add a repository secret TEST_PASSWORD and use it in a workflow step; check that the log shows ***.
4. Enable CodeQL default setup and review the Security tab.
5. Write a short SECURITY.md.
6. Bonus: try pushing a fake token in the GitHub token format to a test branch and observe push protection (use a clearly fake value).

---

❓ FAQ

🤔 How do I store secrets in GitHub?

In Settings, Secrets and variables, Actions, as repository, environment or organisation secrets, and use them in workflows with the secrets context.

🤔 What is Dependabot?

A GitHub feature that alerts you about vulnerable dependencies and opens pull requests to update them, for security fixes or regular version updates.

🤔 What is push protection in GitHub?

Part of secret scanning that blocks a push when it contains a detected secret, before the secret reaches the repository.

🤔 What is CodeQL?

GitHub’s code analysis engine used by code scanning to find security vulnerabilities and code quality problems.

🤔 Are GitHub security features free?

For public repositories, Dependabot, secret scanning and code scanning are free. Some features for private repositories require a paid GitHub security product.

---

🎯 Next Steps

• 🗺️ GitHub Actions Complete Roadmap
• 🔧 GitHub Actions Workflow Syntax
• 📘 Git and GitHub Tutorial: full course