# GitHub's AI Powered Security Platform Sarah Khalife, GitHub | AI Engineer World's Fair 2024 | 23:45 Source: https://www.youtube.com/watch?v=utTqdQpe39A Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks. Page: https://aietalks.com/talks/githubs-ai-powered-security-platform Published: 2025-02-08 Tags: code-generation, guardrails, security ## TL;DR - GitHub is adding AI capabilities across its platform, including GitHub Advanced Security, instead of keeping AI limited to Copilot. - Code scanning auto fix uses CodeQL context to suggest vulnerability fixes inside pull requests, and developers can review, edit, commit, and rerun scans. - AI can help generate custom secret-scanning patterns and identify unstructured passwords, although those findings can include false positives. ## Summary Sarah Khalife describes GitHub Advanced Security and the ways GitHub is adding generative AI to everyday security work. She covers code scanning with CodeQL, third-party results through SARIF, secret scanning with push protection, and supply chain security through Dependabot. Her focus is on reducing the distance between finding a vulnerability and fixing it. Code scanning auto fix uses the data flow and vulnerability context from CodeQL to suggest a change in a pull request. Developers can inspect the suggestion, commit it, and rerun scans. AI also helps create custom regular expressions for secret scanning and analyze unstructured passwords that are difficult to classify with ordinary patterns. A live demo shows organization-level coverage, repository alerts, vulnerable data paths, and an auto-fix suggestion for cross-site scripting. Khalife is clear that developers still need to review AI suggestions and that password detection may initially produce false positives. ## Key ideas ### GitHub is putting AI into platform capabilities beyond Copilot [00:30](https://www.youtube.com/watch?v=utTqdQpe39A&t=30s) Khalife says GitHub wants AI to be part of the platform itself, including collaboration, productivity, and security. She distinguishes improving application security with AI from discussing security risks around AI. GitHub also wants these capabilities to work at scale through integrations and APIs. She says there is never one path that solves every customer problem, so the platform includes third-party integrations and community input. ### GitHub Advanced Security brings application security into the developer workflow [04:58](https://www.youtube.com/watch?v=utTqdQpe39A&t=298s) GitHub Advanced Security adds application security features to the normal GitHub development experience. Code scanning uses CodeQL to find vulnerable patterns, trace data flow, and show the source and exploit information connected to a vulnerability. CodeQL is open source, so users can build their own queries. GitHub also includes queries from the wider community, including Microsoft, Google, and Uber. ### Secret scanning can block exposed secrets before they enter commit history [07:35](https://www.youtube.com/watch?v=utTqdQpe39A&t=455s) Secret scanning checks repositories for API keys, custom secrets, and other credentials. Push protection can block a push before a secret is exposed or added to Git history. Once a secret is already in history, Khalife recommends revoking it rather than deleting history, especially for regulated organizations that need to preserve records. Secret scanning can inspect current files, Git history, pull requests, and pull request comments. ### Security work should be shared by developers and AppSec teams [10:39](https://www.youtube.com/watch?v=utTqdQpe39A&t=639s) Khalife says security should be part of everyone's day-to-day responsibility. AppSec teams should not simply give developers a list of vulnerabilities with an immediate deadline, and developers should not have to fix issues they do not understand. GitHub's goal is to make the conversation easier by bringing security findings and remediation into the developer workflow. ### Code scanning auto fix uses CodeQL context to suggest a repair [12:45](https://www.youtube.com/watch?v=utTqdQpe39A&t=765s) Code scanning auto fix adds an AI-generated suggestion to a pull request after a vulnerability is found. CodeQL supplies context about the vulnerability's data flow and common fixes, which helps the backend generate a more specific result. Developers can edit the suggestion, commit it, and rerun tests and scans. Khalife says customers testing the public beta found it successful for about 70% of their use cases, while making clear that the developer still reviews the answer. ### AI can generate custom secret patterns from examples [14:41](https://www.youtube.com/watch?v=utTqdQpe39A&t=881s) Custom secret patterns often require regular expressions, which can be difficult to write confidently across many repositories. GitHub's custom pattern generation lets a user provide samples and examples, then suggests a pattern as a starting point. Khalife says additional context improves the response. She describes this as reducing the manual work customers were already doing with ChatGPT, Copilot in an IDE, or web searches. ### AI can help distinguish unstructured passwords from harmless text [15:52](https://www.youtube.com/watch?v=utTqdQpe39A&t=952s) Secret scanning can find fields such as password assignments, but many of those values are not real or exploitable credentials. GitHub is using AI to analyze repositories and identify which unstructured passwords are more likely to be true positives. These findings are labeled as other and can include false positives in the first iteration. When a password is confirmed, the recommended response is to revoke or rotate it and move it into a secret store such as HashiCorp Vault or Azure Key Vault. ### Coverage data shows where security scanning is missing [18:52](https://www.youtube.com/watch?v=utTqdQpe39A&t=1132s) In the demo, Khalife uses the organization security view to show alert counts, alert age, remediation timelines, and repository impact. She prefers the coverage view because it shows which repositories actually run secret scanning, code scanning, and Dependabot. The example has 99% secret-scanning coverage and 57% code-scanning coverage. She says this helps administrators and security managers see repositories that are outside the CI pipeline and therefore may not be scanned. ### The pull request is where finding and fixing a vulnerability can meet [21:08](https://www.youtube.com/watch?v=utTqdQpe39A&t=1268s) The demo shows a pull request that introduces cross-site scripting. GitHub Advanced Security explains the vulnerability, while the auto-fix feature gives a specific solution: install and import an HTML-escaping library. Khalife says the developer can review the proposed change and commit it before merging into a main or development branch. GitHub then reruns the scans to check whether the vulnerability was actually remediated. ## Notable quotes - "What we really want to actually do within GitHub is not only incorporate some of the new features and capabilities within Copilot only, but we also want to incorporate it as part of the platform." (00:30) - "With code scanning auto fix, not only are we helping detect vulnerabilities with code scanning, but now we're providing a way to auto fix those with AI." (12:45) - "The faster you're able to fix vulnerabilities, the faster you're able to be a little more productive." (12:12) - "As soon as I commit that fix, it will rerun all the scans so we can see if that vulnerability is actually remediated right off the bat." (22:54) ## Tools & references mentioned - GitHub Advanced Security - GitHub Copilot - CodeQL - Dependabot - SARIF - HashiCorp Vault - Azure Key Vault - Microsoft - Google - Uber - ChatGPT ## Who should watch - You manage application security and need to see which repositories are actually covered by code scanning, secret scanning, or Dependabot. - You want developers to receive vulnerability explanations and suggested fixes inside pull requests before code reaches a main or production branch. - You are evaluating AI-assisted secret scanning and need to understand its use for custom patterns and unstructured passwords, including the possibility of false positives. ## Related talks - [GitHub Next Explorations](https://aietalks.com/talks/github-next-explorations) (Rahul Pandita, GitHub Next, 18:18) - [The Agent Awakens: Collaborative Development with Copilot](https://aietalks.com/talks/the-agent-awakens-collaborative-development-with-copilot) (Christopher Harrison & John Peck, GitHub, 1:04:06) - [Enhancing Quality and Security in CI](https://aietalks.com/talks/enhancing-quality-and-security-in-ci) (Gunjan Patel, Palo Alto Networks, 18:27) - [GitHub Copilot: The World's Most Widely Adopted AI Developer Tool](https://aietalks.com/talks/github-copilot-the-worlds-most-widely-adopted-ai-developer-tool) (Dave Bernes, GitHub, 29:49) - [Git push get an AI API](https://aietalks.com/talks/git-push-get-an-ai-api) (Ryan Fox-Tyler, Hypermode, 45:01)