The Story
Follow the narrative to build a mental model of how everything connects.
The Repository Fortress
Every secure software journey begins at the repository -the fortress that houses your code. Inside, SECURITY.md declares how vulnerabilities should be reported, CODEOWNERS guards sensitive paths, and branch protection rules stand as sentinels ensuring no code enters without proper review and passing checks.
The Secret Sentinels
Before any code crosses the fortress walls, the Secret Sentinels stand guard. Push protection intercepts secrets at the git push boundary -blocking API keys, tokens, and credentials from ever reaching the remote repository. Over 200 partner patterns are on constant watch, and custom patterns extend the vigil to organisation-specific secrets.
The Code Inspectors
Deep within the fortress, CodeQL inspectors treat your source code as a queryable database. They run semantic analysis -not just pattern matching -finding SQL injection, XSS, path traversal, and authentication flaws that surface-level tools miss. The default query suite catches high-confidence issues; the security-extended suite casts a wider net.
The Dependency Watchdog
The Dependabot watchdog patrols the supply chain, sniffing every manifest file for known vulnerabilities. When a CVE is published, it raises an alert instantly. For critical findings, it opens a pull request with the fix before you even notice the problem. Version updates keep dependencies current, and grouped updates prevent PR fatigue.
The Gate Review
At the pull request gate, the dependency review action examines every change to your dependency graph. It surfaces new vulnerabilities, flags disallowed licences, and can block merges if severity thresholds are exceeded. No risky dependency slips through unnoticed.
The Advisory Council
When a vulnerability is discovered, the Advisory Council convenes in private. Repository security advisories provide a confidential space to assess, coordinate, and fix. GitHub, as a CVE Numbering Authority, can assign a CVE number. A private fork allows patches to be developed in secrecy before coordinated public disclosure.
The Supply Chain Ledger
The Supply Chain Ledger records every component in your software. The dependency graph maps all direct and transitive dependencies. SBOM exports in SPDX format satisfy compliance auditors. Artifact attestations and npm provenance link every deployed binary back to its source commit -an unbroken chain of trust.
The Watchtower
High above the fortress, the Security Overview dashboard surveys the entire organisation. Risk views highlight repositories with open critical alerts. Coverage views reveal where GHAS features remain unenabled. Trend lines show whether your security posture is improving or deteriorating over time.
The Security Culture
True security is not just tools -it is culture. Rulesets enforce policies at scale across repositories. Code scanning auto-fix suggests AI-powered remediation. Security campaigns let teams tackle alert backlogs systematically. The goal: every developer is a security practitioner.
The Continuous Cycle
Security is never done. Every push triggers secret scanning, every PR runs code scanning and dependency review, every published advisory updates Dependabot alerts. The cycle is continuous, automated, and ever-watchful -shifting security left into the developer workflow where issues are cheapest to fix.
