Secure Software Starts With a Better Developer Experience
At GitHub, the core principle behind security is straightforward: when developers are empowered, software gets more secure—not by adding more work, but by removing friction. Niroshan Rajadurai, Senior Director of Global GitHub Advanced Security Sales, has spent decades in the security space and helped build CodeQL into the most widely adopted SAST solution available. In a recent conversation, he explains how developer-first security shapes everything from secret management to code review.
Developers Are the Center of Application Security
Effective AppSec doesn't come from simply integrating security tools and scattering results across the SDLC. According to Rajadurai, it requires understanding how developers actually work and embedding security into that flow. Research confirms that developers fix issues faster when security is part of their existing workflow.
Developers are uniquely positioned in the security equation. They write the code that introduces vulnerabilities, and they write the code that fixes them. Giving them tools that fit their workflow isn't just convenient—it's the key to preventing vulnerabilities before they ever reach production. Security teams are still essential, but their role shifts toward scaling their expertise through the developer workflow rather than standing apart from it.
What “Built for Developers” Looks Like in Practice
Push Protection Stops Leaks Before They Happen
Every day, hundreds of credentials are accidentally exposed on GitHub. While GitHub automatically revokes API keys on public repositories and notifies owners, push protection for secret scanning takes prevention one step further. Available to GitHub Advanced Security (GHAS) users, this feature scans pushes before accepting them. If secrets are detected, the push is rejected—protecting credentials while keeping developers in their normal flow.
Security Moves Into the Pull Request
Rather than forcing developers to visit separate security dashboards, GitHub centralizes results where code review already happens. From the pull request, developers can apply fixes immediately, spin up a Codespace to get back into the code in real time, or collaborate with team members to find the context they need. Code scanning results are also visible directly in VS Code and Codespaces, ensuring security is a natural part of the coding experience.
Visualizing Security Across the Organization
For security teams, the security overview provides a high-level summary of an organization's security posture. It gives a simple way to identify which repositories need attention, helping security professionals scale their impact across the entire codebase.
Security That Accelerates Innovation
Fast, continuous innovation depends on securing code in a way that increases—not decreases—developer velocity. When security measures aren't designed for developers, the result is predictable: high noise levels, failed testing, performance degradation, and wasted time. Optimized security flips that around. It lets developers fix issues quickly and keeps organizations shipping continuously.
Why AppSec Hasn't Evolved Like DevOps
The history of DevOps offers useful context. When builds would break after code was pushed to the repository, the industry responded by creating a more developer-friendly process. DevOps was born from that friction, and today broken builds are a rare occurrence.
AppSec never went through a similar transformation. It's still broken largely because it wasn't designed for developers—it was designed as a specialist activity. The future of AppSec is DevSecOps, where security capabilities empower developers just as DevOps empowered continuous delivery.
How GitHub Supports the Next Generation of Secure Development
As the home for 94 million developers, GitHub occupies a unique role in nurturing talent at every stage—from students learning to code to startups scaling to Fortune 500 companies running complex infrastructures. This broad community is also a source of crowd-sourced security intelligence. Developers, security researchers, and academics worldwide contribute to a shared understanding of vulnerabilities and threats. The results are measurable: in 2022, developers updated 50% more vulnerable packages than the previous year, helping secure 18 million projects on GitHub.
Beyond community insights, GitHub's security solutions remain focused on what makes the largest difference: developer velocity and ease of use. It's a formula that keeps security both practical and effective.
