The risk you inherit with every dependency

Vulnerabilities are weaknesses in your code or the libraries you use that attackers can exploit. The important detail to understand is that you inherit any risk from a library the moment you import it into your project, even though you didn’t write the vulnerable code yourself. That’s why even small or brand-new projects can have vulnerabilities—almost all software relies on third-party packages.

GitHub provides a suite of tools to help you find and fix these issues: GitHub Advanced Security (GHAS). On public repositories, you get access to Dependabot, code scanning, secret scanning, and Copilot Autofix without any additional cost. Private repositories require a GHAS license.

Turning on the security tools

Before you can act on any alerts, the relevant tools need to be enabled in your repository:

  1. Go to your repository and click the Settings tab.
  2. In the left-hand bar under "Security," select Advanced Security.
  3. Under "Dependabot," enable both "Dependabot alerts" and "Dependabot security updates."
  4. Scroll to the "Code scanning" section. For "CodeQL analysis," select Set up, then Default from the context menu.
  5. In the new window, select Enable CodeQL without changing any settings.
  6. Scroll down to "Secret Protection" and enable it.

Once enabled, the Security tab at the top of your repository becomes your command center. It shows alerts for exposed secrets, vulnerable dependencies, and risky code paths all in one place.

Handling leaked secrets

Secret scanning watches for sensitive information like API keys and tokens that get accidentally committed. When an alert appears under Secret scanning in the Security tab, click the alert title to see which secret was detected and where it lives in your codebase.

The fix starts with revoking the secret—disabling the old key so it can’t be used anymore. You typically do this by generating a new key on the platform where the secret came from (such as Azure or Stripe). GitHub can’t revoke secrets for you; secret scanning gives you the early warning so a leaked secret doesn't become an exploited one.

After you’ve revoked it, close out the alert:

  1. Select Close as in the top-right of the window.
  2. Choose Revoked from the context menu.
  3. Click the green Close alert button.

Letting Dependabot manage your supply chain

Dependabot is a code scanning tool that keeps your dependencies up to date. Since you inherit vulnerabilities from every library you pull into a project, Dependabot alerts you when it finds known issues in the libraries your project depends on.

From the Security tab, clicking a Dependabot alert takes you to a pull request that updates the affected library. Scrolling down in the pull request lets you view the specific advisory behind the alert via See advisory in GitHub Advisory Database. Before merging, click the green Review security update button to inspect the version bump—reviewing suggested changes is always a good habit. If everything looks good, merge the pull request.

In practice, Dependabot automates turning GitHub security advisories into pull requests, so you don’t have to manually track common vulnerabilities and exposures.

Understanding and fixing code scanning alerts

CodeQL is the engine that produces code scanning alerts. It’s not a linter. Because it understands data flow—where input starts and where it ends up—it can catch a much broader range of issues.

When you open a code scanning alert, it explains the issue and, where possible, provides fixes and examples illustrating the problem and a possible solution. Copilot Autofix can then resolve the alert for you:

  1. Select Generate fix at the top of the alert.
  2. Copilot suggests a patch. Review the change and confirm it addresses your needs.
  3. Click the green Commit to new branch button.
  4. In the pop-up, select Open a pull request and click Commit change.
  5. Treat the generated pull request like any other: review it and merge. Copilot accelerates security fixes, but you stay in control throughout.

Once you’ve enabled and used these tools, your public repositories stay protected from the start. For more background, GitHub’s documentation covers secret scanning, Dependabot alerts, and code scanning alerts in detail. You can also practice your skills with GitHub Skills or the vulnerable-node repository.