Security on the Roadmap: What GitHub Outlined at Universe 2021

GitHub Universe 2021 had plenty to say about security. Across the event's sessions, the company fielded questions on everything from vulnerability reporting workflows to how data from its security products can be pulled into external systems. Here is a rundown of the key announcements and near-future plans that came out of those conversations.

Opening Up Security Data

For teams that want to move GitHub Advanced Security (GHAS) data into other tools, GitHub confirmed that APIs and webhook events are coming for all security product data. This includes code scanning, secret scanning, and Dependabot alerts. The intent is to let you pull data in real time or on a set schedule. If you would rather skip the API, GitHub also noted that an export feature is planned for the organization-level security overview.

Private vulnerability reporting is also on the 2022 agenda. GitHub expects to expand its work in this area, with more detail available in Chief Security Officer Mike Hanley's Universe talk on improving security vulnerability reporting.

Dependabot: From Manifests to Malware Hunting

Dependabot currently checks dependency manifests against the GitHub Advisory Database. GitHub acknowledged that this is not enough to catch malicious packages with no published CVE, and said it is building a dedicated team for this exact problem. The plan involves contributions at the package manager and registry level, as well as changes to GitHub itself. The Security Lab already hunts for vulnerabilities in open source but will push further into malware detection.

Custom extensions for Dependabot and the dependency graph are also in the works. GitHub is developing an API for the dependency graph that allows you to submit information to it, with the goal of working with package managers like Gradle to make it easy to export dependency lists and upload them. A similar initiative is underway for Dependabot, where GitHub is starting to collaborate directly with package managers so they can "add themselves" to the service.

For org-wide visibility, GitHub pointed to the security overview as its central dashboard. Secret scanning results for an entire organization are already displayed there, and work is underway to add Dependabot and code scanning alerts to the same view.

CodeQL Language Support Expands

CodeQL announced beta support for Ruby at Universe, joining C/C++, C#, Java, JavaScript/TypeScript, Python, and Go as supported languages. During the beta, Ruby has a limited query set covering a small number of vulnerability categories, but new queries are being added regularly. Beyond Ruby, GitHub is working on adding Kotlin and Swift to the engine.