--- title: "GH-SEC Study Guide β€” Master GitHub Advanced Security" description: "An interactive study guide built on 7 memory techniques to help you master GitHub Advanced Security -shift-left security for modern DevSecOps teams." url: "https://lucidlabs.com.au/insights/gh-sec" --- # Master the GH-SEC An interactive study guide built on 7 memory techniques to help you master GitHub Advanced Security -shift-left security for modern DevSecOps teams. Secret Scanning 10-15%Code Scanning 15-20%Dependabot 10-15%Security Best Practices 15-20%GitHub Security Features 25-30% What it covers Secret scanning (push protection, custom patterns, partner programs), code scanning (CodeQL, SARIF, third-party tools), Dependabot (alerts, updates, security updates, grouped updates), dependency review, security advisories, security policies, supply chain security, and SBOM. Ideal for Security engineers, DevSecOps practitioners, and developers implementing shift-left security with GitHub. Aspire to this if You're a developer wanting to embed security into your CI/CD pipelines, or a security engineer looking to automate vulnerability detection across your organisation's repositories. Section 1 / Spatial Memory ## The Map Tap any component to see what you need to know for the exam. **πŸ“¦ Repository** Code & Config **πŸ”‘ Secret Scanning** Credential Detection **πŸ” Code Scanning** Static Analysis **🧬 CodeQL** Semantic Queries **πŸ€– Dependabot** Dependency Management **πŸ“‹ Dependency Review** PR Gate **πŸ“’ Security Advisories** Disclosure & Coordination **πŸ”— Supply Chain Security** SBOM & Provenance **πŸ“Š Security Overview** Organisation Dashboard Section 2 / Narrative Memory ## The Story Follow the narrative to build a mental model of how everything connects. πŸ“¦ ### The Repository Fortress Every secure software journey begins at the repository -the fortress that houses your code. Inside, SECURITY.md declares how vulnerabilities should be reported, CODEOWNERS guards sensitive paths, and branch protection rules stand as sentinels ensuring no code enters without proper review and passing checks. **Exam Intel**SECURITY.md = vulnerability disclosure policy. CODEOWNERS = review enforcement for sensitive paths. Branch protection = required status checks, signed commits, linear history. Security tab = unified alert dashboard. πŸ”‘ ### The Secret Sentinels Before any code crosses the fortress walls, the Secret Sentinels stand guard. Push protection intercepts secrets at the git push boundary -blocking API keys, tokens, and credentials from ever reaching the remote repository. Over 200 partner patterns are on constant watch, and custom patterns extend the vigil to organisation-specific secrets. **Exam Intel**Push protection = pre-receive hook that blocks secrets on push. 200+ partner patterns auto-notify providers. Custom patterns = regex with named capture groups. Dry-run mode for testing. Bypass requires audit trail. Delegated bypass = designated reviewers approve exceptions. πŸ” ### The Code Inspectors Deep within the fortress, CodeQL inspectors treat your source code as a queryable database. They run semantic analysis -not just pattern matching -finding SQL injection, XSS, path traversal, and authentication flaws that surface-level tools miss. The default query suite catches high-confidence issues; the security-extended suite casts a wider net. **Exam Intel**CodeQL = semantic SAST, code-as-data. Default setup = zero-config for supported languages. Advanced setup = custom workflow YAML. Three query suites: default (precision), security-extended (breadth), security-and-quality (all). SARIF = standard output format for all tools. πŸ€– ### The Dependency Watchdog The Dependabot watchdog patrols the supply chain, sniffing every manifest file for known vulnerabilities. When a CVE is published, it raises an alert instantly. For critical findings, it opens a pull request with the fix before you even notice the problem. Version updates keep dependencies current, and grouped updates prevent PR fatigue. **Exam Intel**Dependabot = three modes: alerts (notify), security updates (auto-PR for CVEs), version updates (keep current). dependabot.yml in .github/ directory. Grouped updates = combine PRs. 20+ ecosystems. Reachability analysis auto-dismisses low-impact alerts. πŸ“‹ ### The Gate Review At the pull request gate, the dependency review action examines every change to your dependency graph. It surfaces new vulnerabilities, flags disallowed licences, and can block merges if severity thresholds are exceeded. No risky dependency slips through unnoticed. **Exam Intel**Dependency review = GitHub Action in PR workflow. Rich diff of dependency changes. Block on severity threshold (low/medium/high/critical). Licence compliance = fail on disallowed licences. Works with lockfiles for accurate transitive dependency tracking. πŸ“’ ### The Advisory Council When a vulnerability is discovered, the Advisory Council convenes in private. Repository security advisories provide a confidential space to assess, coordinate, and fix. GitHub, as a CVE Numbering Authority, can assign a CVE number. A private fork allows patches to be developed in secrecy before coordinated public disclosure. **Exam Intel**Repository advisories = private disclosure + coordination. GitHub = CNA, can assign CVEs. Private forks for secret fixes. Published advisories propagate to Dependabot alerts ecosystem-wide. GitHub Advisory Database = global catalogue. Private vulnerability reporting = external researchers report securely. πŸ”— ### The Supply Chain Ledger The Supply Chain Ledger records every component in your software. The dependency graph maps all direct and transitive dependencies. SBOM exports in SPDX format satisfy compliance auditors. Artifact attestations and npm provenance link every deployed binary back to its source commit -an unbroken chain of trust. **Exam Intel**Dependency graph = direct + transitive deps. SBOM = SPDX format export. Artifact attestations = Sigstore-based build provenance. npm provenance = package β†’ source commit link. Supply chain = SBOM + provenance + dependency review + Dependabot. πŸ“Š ### The Watchtower High above the fortress, the Security Overview dashboard surveys the entire organisation. Risk views highlight repositories with open critical alerts. Coverage views reveal where GHAS features remain unenabled. Trend lines show whether your security posture is improving or deteriorating over time. **Exam Intel**Security Overview = org-level dashboard. Risk view = repos by open alert severity. Coverage view = GHAS feature enablement. Trends over time. Filterable by team, language, topic. Exportable for compliance reporting. πŸ›‘οΈ ### The Security Culture True security is not just tools -it is culture. Rulesets enforce policies at scale across repositories. Code scanning auto-fix suggests AI-powered remediation. Security campaigns let teams tackle alert backlogs systematically. The goal: every developer is a security practitioner. **Exam Intel**Rulesets = scalable policy enforcement (replace legacy branch protection). Code scanning autofix = Copilot-powered suggestions. Security campaigns = coordinated alert remediation. Organisation-level enablement = GHAS at scale. Custom security configurations = reusable policy templates. πŸ”„ ### The Continuous Cycle Security is never done. Every push triggers secret scanning, every PR runs code scanning and dependency review, every published advisory updates Dependabot alerts. The cycle is continuous, automated, and ever-watchful -shifting security left into the developer workflow where issues are cheapest to fix. **Exam Intel**Shift-left = catch issues early in dev cycle. Push = secret scanning. PR = code scanning + dependency review. Merge = Dependabot monitors. Advisory = ecosystem-wide alerts. CI/CD integration = security as part of the pipeline, not an afterthought. Section 3 / Acronym Memory ## Mnemonic Wall Memorable acronyms and phrases to anchor key exam concepts in your memory. πŸ”‘ SPDC **S**canning, **P**ush protection, **D**ry-run, **C**ustom patterns Secret scanning features in order of deployment: enable scanning, add push protection, test with dry-run, extend with custom patterns. πŸ” DSQ **D**efault setup, **S**ecurity-extended, security-and-**Q**uality CodeQL query suites from narrowest to broadest. Default = high precision. Security-extended = more findings. Security-and-quality = everything. πŸ€– ASV **A**lerts, **S**ecurity updates, **V**ersion updates "ASV -Alerts notify, Security updates patch CVEs, Version updates keep current." Three Dependabot modes. πŸ›‘οΈ GHAS **G**uard secrets, **H**unt vulnerabilities, **A**udit dependencies, **S**ecure supply chain The four pillars of GitHub Advanced Security mapped to its core features. πŸ“‹ SARIF **S**tatic **A**nalysis **R**esults **I**nterchange **F**ormat The standard format for code scanning results. All tools -CodeQL, Semgrep, SonarQube -output SARIF for GitHub ingestion. πŸ“¦ SBOM **S**oftware **B**ill **O**f **M**aterials Complete inventory of software components. Exported in SPDX format from the dependency graph. Required for supply chain compliance. πŸ”— DRAP **D**ependency graph, **R**eview action, **A**dvisories, **P**rovenance "DRAP the supply chain." Four layers of supply chain security from detection to attestation. 🚫 BDA **B**lock, **D**elegate, **A**udit Push protection flow: Block the secret on push, Delegate bypass to reviewers, Audit all bypass events. πŸ—οΈ CDB **C**reate database, **D**efine queries, **B**uild results CodeQL analysis pipeline: Create a database from source, Define queries to run, Build SARIF results. πŸ“Š RCT **R**isk view, **C**overage view, **T**rends Security Overview dashboard sections. Risk = open alerts. Coverage = feature enablement. Trends = progress over time. πŸ” PCAF **P**rivate advisory, **C**VE assignment, private fork for **A**mendment, public **F**ix Coordinated vulnerability disclosure flow: Private advisory β†’ CVE assignment β†’ fix in private fork β†’ publish. βš™οΈ RGCE **R**ulesets, **G**HAS enablement, **C**onfigurations, **E**nforcement Organisation-level security management: Rulesets enforce policies, GHAS enablement at scale, custom security configurations, enforcement via required workflows. Section 4 / Contrast Memory ## Versus Arena Side-by-side comparisons to sharpen your understanding of similar concepts. vs Secret ScanningvsPush Protection Click to compare #### Secret Scanning vs Push Protection | Aspect | Secret Scanning | Push Protection | | --- | --- | --- | | When | After commit reaches remote | Before commit reaches remote | | Action | Alert + notify partner | Block the push | | Remediation | Revoke + rotate secret | Remove secret from commit | | Bypass | N/A -already committed | Delegated bypass with audit trail | | Coverage | Full repo history + wiki | New pushes only | | Custom patterns | Yes -regex with named groups | Yes -same patterns | Click to flip back vs Default SetupvsAdvanced Setup Click to compare #### Code Scanning Setup Modes | Aspect | Default Setup | Advanced Setup | | --- | --- | --- | | Configuration | Zero-config, UI toggle | Custom workflow YAML | | Query suites | Default or extended (UI toggle) | Any suite or custom queries | | Languages | Auto-detected | Manually specified | | Third-party tools | CodeQL only | Any SARIF-producing tool | | Build steps | Automatic | Custom build commands | | Best for | Quick enablement | Custom analysis needs | Click to flip back vs Dependabot AlertsvsSecurity UpdatesvsVersion Updates Click to compare #### Dependabot Feature Comparison | Aspect | Dependabot Alerts | Security Updates | Version Updates | | --- | --- | --- | --- | | Purpose | Notify of CVEs | Auto-PR for CVE fix / Keep deps current | | Trigger | New advisory published | Advisory match / Schedule (daily/weekly) | | Configuration | Enabled in settings | Enabled in settings / dependabot.yml | | Output | Alert in Security tab | Pull request / Pull request | | Scope | Vulnerable deps only | Vulnerable deps / All deps | | Grouped updates | N/A | N/A / Yes -combine PRs | Click to flip back vs CodeQLvsThird-Party SAST Click to compare #### CodeQL vs Third-Party SAST | Aspect | CodeQL | Third-Party SAST | | --- | --- | --- | | Analysis type | Semantic (code-as-data) | Pattern matching / semantic varies | | Integration | Native to GitHub | SARIF upload via Actions | | Setup | Default or advanced | Custom workflow only | | Languages | 9 supported languages | Varies by tool | | Custom rules | CodeQL query language | Tool-specific DSL | | Cost | Included with GHAS | Separate licence often required | Click to flip back vs Repository AdvisoryvsGitHub Advisory Database Click to compare #### Advisory Types | Aspect | Repository Advisory | GitHub Advisory Database | | --- | --- | --- | | Scope | Single repository | Global ecosystem | | Visibility | Private until published | Public | | Created by | Maintainers | GitHub + community + NVD | | CVE assignment | Request from GitHub (CNA) | Already assigned | | Private fork | Yes -fix before disclosure | N/A | | Propagation | Feeds into Advisory Database | Triggers Dependabot alerts | Click to flip back vs Branch ProtectionvsRulesets Click to compare #### Branch Protection vs Rulesets | Aspect | Branch Protection | Rulesets | | --- | --- | --- | | Scope | Single branch pattern | Multiple repos via org rulesets | | Management | Per-repository settings | Centralised org-level | | Layering | One rule per branch | Multiple rulesets can stack | | Bypass | Admin override | Bypass list with audit | | Tag protection | Separate setting | Included in rulesets | | Recommended | Legacy -still supported | Modern approach -preferred | Click to flip back vs SBOMvsDependency Graph Click to compare #### SBOM vs Dependency Graph | Aspect | SBOM | Dependency Graph | | --- | --- | --- | | Purpose | Exportable compliance document | Live in-repo dependency map | | Format | SPDX JSON | GitHub UI / API | | Includes | All components + metadata | Direct + transitive deps | | Use case | Audits, regulatory compliance | Dependabot, dependency review | | Provenance | Static snapshot | Dynamic, auto-updated | | Downstream | External tools | Powers GHAS features | Click to flip back Section 5 / Grouping Memory ## Cheat Sheet Organised reference grouped by exam domain β€” everything you need on one page. ### Secret Scanning 10-15% #### Core Features - 200+ partner patterns detected automatically - Push protection blocks secrets pre-receive (git push boundary) - Custom patterns: regex with named capture groups - Partner program: auto-notify service providers on exposure - Dry-run mode: test custom patterns before enforcement #### Push Protection - Blocks at push time, not commit time - Delegated bypass: designated reviewers approve exceptions - All bypass events are audit-logged - Can be enforced at org level via custom security configurations - Users see remediation guidance when blocked #### Operations - Alerts show secret type, location, commit SHA, and validity - Validity checks: GitHub verifies if secret is still active - Non-provider patterns: generic high-entropy string detection - Historical scanning: scans full repo history on enablement - Excluded paths: configure via secret\_scanning.yml ### Code Scanning 15-20% #### CodeQL - Semantic analysis: treats source code as a queryable database - Supported: C/C++, C#, Go, Java/Kotlin, JS/TS, Python, Ruby, Swift - Default setup: zero-config, auto-detects languages - Advanced setup: custom workflow YAML, build steps, query packs - Query suites: default β†’ security-extended β†’ security-and-quality #### SARIF & Integration - SARIF = Static Analysis Results Interchange Format (OASIS standard) - All tools output SARIF for unified alert experience - Upload via upload-sarif action in GitHub Actions - Third-party tools: Semgrep, SonarQube, Checkmarx, Snyk, etc. - Results appear as code scanning alerts in Security tab + PR checks #### Alert Management - Dismiss as: false positive, used in tests, won't fix - Autofix: Copilot-powered fix suggestions for CodeQL alerts - Alert severity: error, warning, note - Branch filtering: alerts tracked per branch (default branch primary) - Security campaigns: coordinated remediation of alert backlogs ### Dependabot 10-15% #### Three Modes - Alerts: notify when dependencies have known CVEs - Security updates: auto-PR to patch vulnerable dependencies - Version updates: scheduled PRs to keep all deps current #### Configuration - dependabot.yml in .github/ directory - Package ecosystems: npm, pip, Maven, NuGet, Docker, Actions, Bundler, Cargo, Composer, Go, Gradle, Hex, pub, Terraform, and more - Schedule: daily, weekly, monthly for version updates - Grouped updates: combine multiple dependency PRs - Allow/deny lists: control which deps to update - Registries: private registry authentication #### Advanced - Reachability analysis: auto-dismiss alerts for unreachable code - Compatibility scores: shows CI pass rate for updates - Auto-merge: combine with branch protection for hands-free patching - Dependabot secrets: scoped secrets for private registry access - Ignore conditions: suppress specific updates ### Security Best Practices 15-20% #### Repository Security - SECURITY.md: vulnerability disclosure policy - CODEOWNERS: enforce reviews for security-sensitive paths - Branch protection / rulesets: required checks, signed commits - Least privilege: minimum permissions for tokens and apps - Secret rotation: regular rotation schedule + automated detection #### Shift-Left Security - Pre-commit hooks: local secret scanning before push - PR checks: code scanning + dependency review as required checks - IDE integration: CodeQL for VS Code for local analysis - Security training: CodeQL query writing as security education - Threat modelling: identify risks before writing code #### Organisational Policies - Custom security configurations: reusable GHAS policy templates - Rulesets: enforce policies across repos at org level - Required workflows: mandate security checks for all repos - Audit log: track all security-related events - SAML SSO + SCIM: identity governance for GitHub orgs ### GitHub Security Features 25-30% #### Security Overview - Org-level dashboard: risk view, coverage view, trends - Filter by team, language, topic, severity - Exportable reports for compliance - Alert metrics: mean time to remediate, open/closed trends #### Supply Chain Security - Dependency graph: direct + transitive dependency map - SBOM: SPDX format export for compliance - Artifact attestations: Sigstore-based build provenance - npm provenance: package β†’ source commit linking - Dependency review action: PR gate for risky deps #### Advisories & Disclosure - Repository security advisories: private disclosure + coordination - GitHub Advisory Database: global vulnerability catalogue - GitHub is a CVE Numbering Authority (CNA) - Private forks: fix vulnerabilities before public disclosure - Private vulnerability reporting: external researcher intake #### Access & Governance - GitHub Apps: fine-grained permissions over PATs - Fine-grained PATs: repo-scoped, expiring tokens - Deploy keys: read-only or read-write per repo - IP allow lists: restrict org access by network - Audit log streaming: SIEM integration for security events Section 6 / Method of Loci ## The Memory Palace Walk through themed rooms β€” each object anchors a concept in spatial memory. ### The Gate Secret Scanning -Where credentials are caught πŸ”‘ Partner Patterns 200+ token types detected automatically. Partner program notifies providers on exposure 🚫 Push Protection Blocks secrets at git push boundary. Delegated bypass with audit trail πŸ”§ Custom Patterns Regex with named capture groups for org-specific secrets. Dry-run before enforcement βœ… Validity Checks GitHub verifies if detected secrets are still active with the partner πŸ“œ Historical Scanning Full repo history scanned on enablement. Covers commits, issues, PRs, wikis βš™οΈ Excluded Paths secret\_scanning.yml to skip test fixtures, docs, or generated files ### The Analysis Chamber Code Scanning -Where vulnerabilities are found 🧬 CodeQL Engine Semantic SAST -code as queryable database. 9 supported languages ⚑ Default Setup Zero-config: toggle in UI, auto-detect languages, auto-select queries πŸ”§ Advanced Setup Custom workflow YAML, build steps, query packs, third-party tools πŸ“‹ SARIF Format Standard output format. CodeQL, Semgrep, SonarQube -all produce SARIF πŸ€– Autofix Copilot-powered fix suggestions for CodeQL alerts. Accept or modify πŸ“Š Query Suites default (precision) β†’ security-extended (breadth) β†’ security-and-quality (all) ### The Dependency Vault Dependabot & Supply Chain -Where packages are tracked πŸ”” Dependabot Alerts CVE notifications for vulnerable dependencies. Auto-dismiss via reachability analysis πŸ”’ Security Updates Auto-generated PRs to patch known vulnerabilities in dependencies πŸ“¦ Version Updates Scheduled PRs via dependabot.yml. Grouped updates reduce PR noise πŸ•ΈοΈ Dependency Graph Maps direct + transitive deps. Powers Dependabot + dependency review πŸ“„ SBOM Export SPDX format for compliance. Complete inventory of all components πŸ“‹ Dependency Review PR action: block on vulnerability severity or disallowed licences ### The Advisory Hall Advisories & Disclosure -Where vulnerabilities are coordinated πŸ“ Repository Advisories Private vulnerability disclosure and coordination before public release 🌐 Advisory Database Global catalogue: GitHub-reviewed + NVD + community contributions 🏷️ CVE Assignment GitHub is a CNA -can assign CVE numbers for open-source vulnerabilities πŸ”€ Private Forks Develop fixes in private before coordinated public disclosure πŸ“¬ Private Reporting External researchers report vulnerabilities securely via repository settings πŸ”— Propagation Published advisories flow to Advisory Database β†’ Dependabot alerts ecosystem-wide ### The Command Centre Security Overview & Governance -Where posture is managed πŸ“Š Security Overview Org dashboard: risk view, coverage view, trends. Filter by team/language/severity πŸ“ Rulesets Org-level policy enforcement across repos. Replaces legacy branch protection βš™οΈ Security Configurations Reusable GHAS policy templates. Apply to repos at scale πŸ“‹ Audit Log All security events logged. Streaming to SIEM for real-time monitoring πŸ” Access Controls GitHub Apps, fine-grained PATs, deploy keys, IP allow lists, SAML SSO + SCIM πŸ—οΈ Attestations Sigstore-based artifact attestations. npm provenance for package integrity Section 7 / Pattern Recognition ## Pattern Spotter Decision trees and trigger-answer pairs β€” see the pattern, know the answer. Secret Found -What Happens? Secret Found -What Happens? Β Β β”œβ”€β”€ Push protection enabled? β†’ Yes β†’ Block push, show remediation guidance, offer delegated bypassΒ Β β”œβ”€β”€ Partner pattern detected? β†’ Yes β†’ Alert created + partner notified automatically for revocationΒ Β β”œβ”€β”€ Custom pattern match? β†’ Yes β†’ Alert created, no partner notification (org-specific secret)  └── Already committed to history? β†’ Revoke immediately, rotate credentials, remove from history if needed Which Code Scanning Setup? Which Code Scanning Setup? Β Β β”œβ”€β”€ Supported language, standard build? β†’ Default setup -zero-config, toggle in repository settings UIΒ Β β”œβ”€β”€ Need custom build steps? β†’ Advanced setup -custom workflow YAML with build commandsΒ Β β”œβ”€β”€ Need third-party tool? β†’ Advanced setup -add tool step, upload SARIF via upload-sarif action  └── Want broadest coverage? β†’ security-and-quality suite (includes code quality + security rules) Vulnerable Dependency Detected Vulnerable Dependency Detected Β Β β”œβ”€β”€ CVE published for a dependency? β†’ Dependabot alert created in Security tab with severity and fix versionΒ Β β”œβ”€β”€ Security updates enabled? β†’ Auto-PR opened with minimum version bump to fix vulnerabilityΒ Β β”œβ”€β”€ PR introduces new vulnerable dep? β†’ Dependency review action blocks merge if severity threshold exceeded  └── Alert for unreachable code path? β†’ Reachability analysis auto-dismisses as low impact Vulnerability Disclosure Flow Vulnerability Disclosure Flow Β Β β”œβ”€β”€ Vulnerability discovered internally? β†’ Create repository security advisory (private). Request CVE from GitHubΒ Β β”œβ”€β”€ External researcher reports? β†’ Private vulnerability reporting β†’ maintainer receives private notificationΒ Β β”œβ”€β”€ Fix ready? β†’ Develop in private fork. Merge and publish advisory simultaneously  └── Advisory published? β†’ Flows to GitHub Advisory Database β†’ triggers Dependabot alerts ecosystem-wide ## Decision Cards Need to prevent secrets from being pushed?β†’Enable push protection -blocks at git push boundary. Delegated bypass for exceptions with audit trail. Want to detect org-specific secrets?β†’Create custom patterns with regex and named capture groups. Use dry-run mode to test before enforcement. Need code scanning with zero configuration?β†’Use default setup -toggle in repo settings. Auto-detects languages, selects appropriate query suite. Want to integrate a third-party SAST tool?β†’Use advanced setup workflow. Run tool in Actions, output SARIF, upload via upload-sarif action. Need to keep all dependencies up to date?β†’Configure version updates in dependabot.yml. Use grouped updates to reduce PR noise. Set schedule: weekly. Want to block PRs introducing vulnerable deps?β†’Add dependency-review-action to PR workflow. Set fail-on-severity threshold (e.g., high). Need a complete software inventory?β†’Export SBOM from dependency graph in SPDX format. Includes all direct and transitive dependencies. Want to coordinate private vulnerability disclosure?β†’Create repository security advisory. Fix in private fork. Request CVE from GitHub (CNA). Publish when ready. Need to enforce security policies across all repos?β†’Use org-level rulesets + custom security configurations. Apply GHAS features at scale via enablement settings. Want to measure security posture across the org?β†’Security Overview dashboard: risk view for open alerts, coverage view for feature enablement, trends over time. Need build provenance for published packages?β†’Use artifact attestations (Sigstore) in GitHub Actions. For npm, enable provenance to link package β†’ source commit. Want AI-powered fix suggestions for code scanning alerts?β†’Enable code scanning autofix (Copilot). Suggests fixes for CodeQL alerts. Review and accept or modify. Ready to certify? ## Train with practitioners, not presenters Lucid Labs delivers Microsoft certification training led by Microsoft Certified Trainers (MCTs) and grounded in real-world project experience. We adapt every session to your team's environment, data stack, and business objectives β€” because the best exam prep comes from engineers who build these solutions every day. πŸ”‘ Secret Scanning Mastery Hands-on labs configuring push protection, custom patterns, and partner program integrations across real repositories. 🧬 CodeQL Deep Dive Write custom CodeQL queries, understand semantic analysis, and integrate third-party SAST tools via SARIF. πŸ€– Dependabot & Supply Chain Configure Dependabot for alerts, security updates, and version updates. Implement dependency review and SBOM exports. πŸ“Š Organisation-Scale Security Deploy GHAS across your organisation with rulesets, custom security configurations, and Security Overview dashboards. [Talk to us about GitHub Advanced Security training](https://lucidlabs.com.au/#contact?service=training-consulting&message=I'm%20interested%20in%20GitHub%20Advanced%20Security%20training%20for%20my%20team.) Custom training for teams & individuals β€” remote or on-site across Australia ![Keith Oak](https://lucidlabs.com.au/team/koak-400.jpg) Keith Oak Chief Technology Officer β€” Lucid Labs Microsoft Solutions Partner architect specialising in Fabric, Azure Data & AI, and GitHub Enterprise. 18+ years delivering data platforms for Australian businesses β€” building the systems these exams test every day. [LinkedIn β†—](https://www.linkedin.com/in/keithoak/)[lucidlabs.com.au β†—](https://lucidlabs.com.au/)Published 29-03-2026