15. Security & Best Practices

In software development, security should never be an afterthought. Because GitHub hosts millions of open and private repositories, it provides powerful, native security tools to protect your source code, monitor package vulnerabilities, and prevent accidental credential leaks. In this final chapter, we will study these security tools and review industry best practices.

1. Dependency Scanning with Dependabot

Modern applications rely on dozens of third-party libraries (e.g., packages inside package.json). If any of these packages have security flaws, your application becomes vulnerable.

Dependabot is a built-in vulnerability scanner that:

• Automatically scans your package files against the GitHub Advisory Database of known bugs and exploits.
• Sends you **Dependabot Alerts** indicating which packages are vulnerable and their severity level (Low, Moderate, High, Critical).
• Automatically **opens Pull Requests** to update your vulnerable package files to safe, updated versions!

To activate Dependabot: Go to repository **Settings > Code security and analysis** and enable"Dependabot alerts" and "Dependabot security updates".

2. Preventing Leaks with Secret Scanning

One of the most common security mistakes is accidentally committing sensitive files (like `.env`) or hardcoding database passwords, API keys (e.g., Stripe, AWS keys), and SSH keys, then pushing them to GitHub. Once pushed, these keys can be scraped by automated bots in seconds.

GitHub provides **Secret Scanning** to prevent this:

• Scans all commits, files, and issues in your repository for known API key patterns.
• If a secret is found, GitHub immediately alerts you and automatically contacts the service provider (e.g., AWS, Stripe) to **revoke the compromised key**, neutralizing the threat immediately!
• You can also enable **Push Protection**, which automatically blocks commits from being pushed if they contain visible secrets.

3. Secure Collaboration Checklists

Follow these baseline rules to safeguard your code repositories:

1. Enable 2FA (Two-Factor Authentication): Protect your GitHub account with an authenticator app. This is now mandatory for active developers on GitHub.
2. Minimize Repository Access: Never give write permissions to team members who only need to read the code. Use organization roles.
3. Never commit secret keys: Always utilize `.gitignore` to exclude env configurations.
4. Always use Branch Protection: Ensure branch updates go through reviewed Pull Requests.

4. AI-Assisted Coding: GitHub Copilot

GitHub Copilot is an AI programmer assistant trained on billions of lines of public code. It integrates directly into your text editor (like VS Code or JetBrains) to:

• Suggest single lines or complete functions as you type.
• Convert natural language comments into working code blocks.
• Autofill boilerplate code, unit tests, and help debug errors quickly.