GitHub Advanced Security Lands in Azure DevOps Public Preview
Web applications now underpin everything from shopping and remote work to hospital operations and critical infrastructure. Yet that ubiquity has a cost: applications remain a leading attack vector, accounting for over 40% of data breaches, according to Verizon’s 2022 Data Breach Investigations Report.
GitHub Advanced Security (GHAS) was built to embed application security testing directly into the developer workflow, so teams aren't waiting months to remediate findings. The company reports that CodeQL-identified vulnerabilities have a 72% fix rate when detected during a pull request, versus a 15% industry norm seven days after discovery. GitHub credits this approach with helping users fix 24 million vulnerable packages in 2022 alone.
Starting today, GHAS enters public preview on Azure DevOps. The full suite—secret scanning, dependency scanning (SCA), and code scanning (SAST)—now operates natively within Azure Repos and Pipelines, eliminating the need to switch contexts for security checks.
Secret Scanning: Catching Leaks Before They Escalate
Stolen credentials appear in nearly 50% of security incidents, so early detection matters. With GHAS for Azure DevOps, secret scanning is available out of the box—no extra tooling required. Enabling it across repositories immediately surfaces exposed secrets; GitHub reports detecting over 1.7 million such exposures in 2022.
Dependency Scanning: Hardening the Software Supply Chain
Open source vulnerabilities—from supply chain attacks to Log4Shell-style issues—demand proactive monitoring. GHAS for Azure DevOps identifies the open source packages used in Azure Repos and offers upgrade guidance to close known vulnerabilities. This delivers software composition analysis (SCA) without leaving the Azure ecosystem.
Code Scanning: Static Analysis Inside Azure Pipelines
GHAS's CodeQL engine powers static analysis for a wide range of languages, including C#, C/C++, Python, JavaScript/TypeScript, Java, and Go. By integrating CodeQL scans directly into Azure Pipelines, developers can detect hundreds of security vulnerability classes during the build process rather than after code ships.
Teams interested in trying the preview can sign up here. GitHub says it will work to enable enrolled Azure DevOps organizations as quickly as possible.
