How GitHub secures
open source software
Learn how GitHub works to protect you as you use,
contribute to, and build on open source.

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

PAG E — 1

GitHub’s role in securing
open source software
Open source software is everywhere,
powering the languages, frameworks, andapplications your team uses every day.
A study conducted by the Synopsys Center for Open
Source Research and Innovation found that enterprisesoftware is now comprised of more than 90 percent
open source code—and businesses are taking notice.
The State of Enterprise Open Source study by Red Hat
confirmed that “95 percent of respondents say open
source is strategically important” for organizations.
Making code widely available has changed how
software is built, with more reuse of code and complex
dependencies—but not without introducing security
and compliance concerns. Open source projects, likeall software, can have vulnerabilities. They can even be
the target of malicious actors who may try to use open
source code to introduce vulnerabilities downstream,
attacking the software supply chain. These threats
expose your organization to additional risk.

That’s why we’ve built tools and processes that allow
organizations and open source maintainers to code
securely throughout the entire software development
lifecycle. Taking security and shifting it to the left allows
organizations and projects to prevent errors and failures
before a security incident happens.
GitHub works hard to secure our community andthe open source software you use, build on, andcontribute to. Through features, services, and security
initiatives, we provide the millions of open source
projects on GitHub—and the businesses that rely on
them—with best practices to learn and leverage acrosstheir workflows.

Making open source
more secure
GitHub Advisory Database, vulnerable
dependency alerts, and Dependabot

At GitHub, we see security as an issue we need toaddress as a community: one that affects all software,
regardless of how much proprietary code it contains.
Similarly, a safe and healthy open source community
isn’t just good for open source software. It also
benefits the millions of businesses that depend on it.

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

PAG E — 2

One of the key elements of identifying security issues
is working with a rich database of vulnerabilities.
GitHub’s dependency vulnerability detection tools use
a combination of data directly from GitHub Security
Advisories and the National Vulnerability Database(NVD) to create a complete picture of vulnerabilities inopen source. This combined dataset lives in the GitHub
Advisory Database and powers Dependabot alerts andsecurity updates. The Advisory Database is also undera Creative Commons Attribution 4.0 license, meaning
it’s freely available for anyone to use as long as they
attribute GitHub as the data source.
To generate automated fixes, we start with CVE alerts,
which describe vulnerable and remediated versions, thenidentify susceptible repositories using their respective
language dependency management definitions. This
allows us to parse a repository’s manifest and alert
their administrators to vulnerable dependencies and,specifically, to the versions they need to update to inorder to remediate these issues. Since the launch of
security alerts in 2017, we’ve sent alerts on more than 89
million vulnerabilities found in open source repositories.

89,125,270

Security vulnerability alerts sent (as of March 18, 2020)

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

Although similar capabilities are available in thirdparty tools, our research shows that many open source
repositories don’t take full advantage of them. Being
notified about vulnerabilities via alerts is only partof solving the problem. Our data also shows that ofthose 89 million vulnerability alerts, a surprising 70
percent remained unfixed a month post notification.
Although they’re now aware a vulnerability exists,many developers and administrators aren’t sure how toresolve it—leaving their applications open to security
issues and attacks. To help, GitHub suggests automatic
fixes. Once a vulnerability is found, we use Dependabot
to automatically create a pull request for known
vulnerabilities that allow you to quickly merge and deploy
remediating changes to your codebase. That means eachsecurity alert now includes a severity level, a link to theaffected file in your project, and a link to a pull request
with the automated security fix.
GitHub also makes it easier for open source project
maintainers to address and share newly-found security
vulnerabilities. Rather than relying on mailing lists,
open source groups, release notes, or changelogs
to communicate with their users, projects can now
communicate directly on GitHub. GitHub is a CVE
Numbering Authority (CNA) and is authorized to assign
CVE identification numbers. Thanks to this capability,
maintainers can request a CVE number for an issue
they’re dealing with, and publish information directly on
GitHub so that developers within the GitHub community
see the advisory first. This allows us to generate security

PAG E — 3

vulnerability alerts for the entire community and sharethem first on GitHub.
But maintainers don’t always mark the security fixes
they find—so finding these commits among the vast
number of GitHub processes every day requires someextra help. Our machine learning model sifts through allcommits on dependency files and extracts the ones thatmight be related to a security release. The model uses
diffs and commit messages to learn how the required
version range changed and understand the intent of thechange. Then it aggregates over time to determine if adependency has released a new version with a security
fix that should trigger an alert.

What’s next
Today, GitHub supports security alerts andautomated security updates for NuGet, Python,Ruby, npm, Yarn, Composer and Maven
ecosystems—but any open source maintainer
can publish an advisory on GitHub as it applies totheir project. We’ll continue adding internally andexternally sourced updates to our vulnerability
data, helping projects better understand theirrisks. And we plan to continue adding support
for more ecosystems.

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

Responsible disclosure and access
Despite code scanning and protection from malicious
actors, vulnerabilities will inevitably be found. And when
they are, GitHub makes vulnerability disclosure andmanagement as simple as possible.
To start, we released our Security Advisory API toprovide security advisories as a public service. A building
block toward a powerful security platform, it provides
a way to access the security feeds we aggregate andvalidate, plus the dependency upgrades we monitor
across millions of projects. Now vulnerability data iseasily available and ready to be integrated into the tools
and workflows you already use.
The Security Advisory API also provides additional
capabilities and complements the NVD feeds withconcerns like malware and other vulnerabilities that
GitHub Security Lab has found and shared. As a public
service, the API provides a foundation for GitHub,
researchers, and integrators to collectively create moresecure software for all of us.
In order to improve the security of the open source
supply chain, maintainers can fix and disclose theexistence of vulnerabilities by publishing advisories intheir GitHub repositories. Advisories created through thisfeature are then curated through our internal advisory
database service and broadcast through dependency
alerts, our external database, and the API. Users can also
request and be assigned CVE identifiers.

PAG E — 4

Ultimately, our goal is to better understand how security
vulnerabilities start—and use this information to improvecode vulnerability tools and identify issues earlier.

What’s next
We plan to expand our traceability features,
including Git history details on when the vulnerability
was introduced, what reviews were associated withit, and more.

Packages
When you work on a project that has dependencies on
packages, it’s important to trust them, understand theircode, and connect with the community who built them.
And inside organizations, you need to be able to quickly
find which packages have been approved to use. GitHub
Packages makes it easy to use the same familiar GitHubinterface to find public packages anywhere on GitHub,
as well as private packages within your organization
or repositories—securely. You can safely discover,use, and publish public and private packages in one
place. Packages hosted on GitHub also include all theinformation you need—package contents, download
statistics, version history, and more.

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

What’s next
GitHub Packages supports familiar package
management tools: JavaScript (npm), Java (Maven),
Ruby (RubyGems), .NET (NuGet), and Docker images
today, with many more to come.

Dependency insights
Security isn’t just limited to individual repositories.
Understanding your entire organization’s security relies
on much more, like understanding which languages you
depend on so your team has the right staff to support

PAG E — 5business-critical applications. Most of all, security
relies on understanding how healthy your software isin real time.
GitHub gives organizations access to dependency
insights, allowing teams to browse all software
dependencies in use at one time, in one place.
Dependency insights also make it easy to quickly filterand view dependencies with security advisories, or ones
using a particular license—something especially criticalfor organizations with strict security and compliancepolicies. Finally, we’ve made it possible to list all therepositories and dependency manifests that include aparticular dependency, so you can upgrade or remove
dependencies that don’t meet their requirements.

What’s next
We’ll continue to expand our dependency insights
dashboard to include integrations and reporting alongwith other security tools.

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

PAG E — 6

Token scanning
Ensuring open source projects don’t rely on vulnerable
libraries is one way to make an immediate impact.
Another is to help projects build and enforce secure
coding practices and prevent security vulnerabilities
before they are exposed. Repository access credentials
are critical to keeping code secure, and are generally
managed by teams.
Still, even the most secure organizations eventually makea mistake, and when leaked, access tokens become easytargets for attackers. Just as we’ve brought vulnerability
and dependency security information natively to ourplatform, we want to help protect developers fromleaking secrets as well.
The first step is GitHub token scanning—a scalable,
real-time code scanning platform that we use to inspect
incoming commits for sensitive information. Token
scanning detects credentials from several platforms,
including Amazon Web Services, Microsoft Azure,
Google Cloud Platform, Slack, and Stripe. In public
repositories, if a developer accidentally commits acredential to any of the supported services, we work withthose services to identify the disclosure and proactively
invalidate the credentials before malicious actors can use
them in a compromising way. We’ve already identified
millions of tokens since launching token scanning in 2018,
and look forward to working with even more formats andtools going forward.

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

What’s next
We’ll help organizations build on what’s currently
available for public repositories. Organizations will
be able to scan for tokens they define, including
potential formats looking for personally identifiable
information and other sensitive data.
Beyond these token formats, we’ll continue to build
on GitHub’s code scanning platform, adding morefeatures and integration points that can:• Detect common security vulnerabilities in code
as it’s being written• Detect more vulnerabilities, like username or
password disclosures
And to support security features built by GitHub
and the community, our Machine Learning and Data
Science Teams will work through petabytes of data
to better identify security issues. Knowing thesewill allow us to alert developers before vulnerable
code gets merged and help them write more secure
software from the start. Our goal is to stop open
source projects from ever introducing security
vulnerabilities, instead of only responding whenthey’re found.

Activity insights
Open source projects are more than just their code. Like
any organization, their popularity and impact ebb andflow over time. The most important toolchain today may

PAG E — 7

see its usage drop to near zero in just months. GitHub
makes it easier for users to understand what’s behind thecode in each open source project.
With the Activity dashboard, organizations can haveinsights about the work their teams are doing. The
dashboard provides information on development
patterns, how your team is using the GitHub platform,
dependency vulnerabilities, and GitHub issues. Teams
can use this data to make better decisions and build
more secure software by staying informed—like knowing
the development languages used organization-wide andbeing aware of security vulnerabilities and how they’re
resolved.
Our activity insights also help organizations understandhow their teams are using GitHub to collaborate andwork on code. These insights also help you track, report,
and act on your organization’s open source usage.

Platform security, compliance, and health
To properly protect the code in GitHub projects, we needto make sure the platform itself is secure. Maintaining asoftware solution that services over 40 million users andthousands of businesses is a large task, especially when
there are active efforts to try and cause disruption—
including the largest DDOS attack yet recorded inearly 2018.
Along with securing our platform, compliance is an
important part of our security work. We’re proud to
say GitHub is SOC II compliant and has FedRAMP
low certification.

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

Making it safe to buildon open source code
As open source code gets more secure, sodoes the internal software that depends on
it. While we use the same tools, features, andproducts to protect your private repositories,
we also want to help your teams manage
external code as well.
The first piece of this strategy is GitHub Connect: a
set of features that brings tighter integration between
GitHub Enterprise Cloud, our SaaS-based solution,
and GitHub Enterprise Server, our self-hosted solutionthat can run on-premises, behind your firewall, or ina private cloud.

GitHub Connect
Secure open source is only helpful if you can easily
use it within your own business. GitHub Connect lets
you safely and securely connect to the world’s largest
community of software developers and open source
projects on GitHub while keeping your most critical code
protected behind the firewall. It also allows us to deliverfeatures and data sourced from the public on GitHub toyour business environment.
With unified search, developers can search open sourceand private repositories directly from within GitHub

PAG E — 8

Enterprise. Direct access to these repositories means
you can leverage existing projects and better understandwhat your users are looking for—all within a moremanaged, visible, and secure workflow.
You can also take advantage of GitHub data—including
critical security alerts and a clear path to vulnerability
mitigation—through GitHub Connect. Developers andorganizations are fixing vulnerabilities in their projects,
but they don’t necessarily notify others. With visibility
into the aggregate data behind these fixes, we make sure
you aren’t using a vulnerable or outdated library—and
we alert you if you do.
Finally, as a development leader you have manydecisions to make, but GitHub Connect eliminates one
important choice: staying on-premises or using thecloud. Connect to a community of innovation, maximize
operational efficiencies, stay more secure, and provide
unmatched developer experience—all while keeping yourcode as close as you need it to be.

What’s next
These features are just the beginning. Next we’ll
integrate the fork and pull workflow used acrossopen source projects today into GitHub Enterprise.
Organizations will be able to fork code using a single
encrypted gateway from GitHub into their enterpriseenvironment, and have local access to it. You’ll haveaccess to the code, not just the released binaries,
allowing you to scan and investigate with yourown tools. And connected to GitHub, you can keep
libraries up to date with just the push of a button,
making it easy to integrate the latest security andcritical bug fixes.
Further extending our searching capabilities,business administrators will have control overthe code available by restricting the open source
libraries users can bring into your environment
based on license, reputation, or other factors.
And by using the GitHub dependency graph, you
can verify that all libraries in use came throughapproved channels.
Open source inside your organization isn’t just about
consuming the code; it’s also about sharing code.
Whether you’re sharing your own projects with theworld or upstreaming your bug fixes and patches
to reduce overhead, GitHub Connect provides aconnection from your secure environment to theopen source projects on GitHub. More than just a

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

PAG E — 9

pull request, it will allow you to add additional checks
to ensure that these open source patches or libraries
have met your internal approvals, including legal,
technical, and in some cases, upper management
sign off as well. Building on the open source
workflows that developers are used to—but withadded review, approval, and compliance—can helporganizations get the most out of open source.

GitHub as an extensible platform
GitHub has always had a best-of-breed philosophy.
We’re building a platform that allows our partners tocreate seamless integrations and extend GitHub withnew features, functionalities, and workflows. This
strategy also holds true for security tools.
We’ve seen different organizations take different
strategies with their security workflows. Somebusinesses integrate the one tool that best meets theirneeds, while others integrate multiple tools with the ideathat breach prevention is worth any amount of money
spent. With the introduction of GitHub Actions, it’s easierthan ever to integrate the tools you need.

keep your business secure. And when new tools comealong, you can update or replace existing tools as easily
as you added them.
If you use in-house tools to manage threat intelligence oridentify software vulnerabilities, you can also integrate
those into our platform using our APIs or replace them asnecessary. Creating your own alerts within our Advisory
Database or using our dependency APIs to better
understand the libraries and code already in use canhelp you shift security left—integrating and benefitingfrom your strategies earlier in your software lifecycle.

What’s next
GitHub’s platform strategy is only accelerating, withadditional integrations, partners adding support for
GitHub, and new data sets to make our partners’
interactions even richer. Just like how the best
software is built by a diverse team of developers,
the best software is developed by a diverse set oftools. At GitHub, we want to make this easier andmore powerful.

Whatever your strategy is, you likely don’t want to leave
security to chance. Being able to integrate tools fromleaders in the security space—including Black Duck, HP,
IonChannel, Sonatype, Snyk, and White Source—ensures
you’re able to use the latest applications and services to

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

PAG E — 10

Questions about using open source in yourorganization? We’re here to help.
SALES@GITHUB.COM
GITHUB.COM/ENTERPRISE

HOW GITHUB SECURES OPEN SOURCE SOFT WARE

PAG E — 11