Why Developers Keep Shipping Vulnerable Code
A recent Secure Code Warrior survey found that 86% of developers don't treat application security as a top priority—even though 85% of codebases contain known open source vulnerabilities. That gap between perception and reality is exactly what the GitHub Security Lab is trying to close through research, education, and community engagement. Understanding the most common weakness classes is the first step toward writing code that doesn't end up on a CVE report.
The Vulnerability Classes You'll Actually Encounter
Vulnerabilities are code flaws that let attackers leak private data, tamper with code, or destroy information. The specific types you'll face depend heavily on your framework and language, but several categories show up across nearly every stack.
SQL Injection
SQL injection happens when unsanitized user input gets concatenated into SQL statements, letting attackers inject their own query logic. The consequences range from unauthorized data access to full data loss and altered application behavior. Two common variants:
- Modifying a query to return extra results the user shouldn't see, such as payment records.
- UNION attacks that pull data from unrelated database tables.
Command Injection
Command injection occurs when an attacker sneaks operating system commands into an application that executes them with the host system's privileges. This can compromise the application, its data, connected servers, and surrounding infrastructure. Typical attack vectors include:
- Arbitrary command injection, where the application accepts system commands directly from any user.
- Arbitrary file uploads, where uploads with dangerous extensions land in the webroot and become executable.
- XML external entity (XXE) injection, which lets attackers read arbitrary server files or trigger denial-of-service conditions.
Cross-Site Scripting (XSS)
XSS is a web-specific attack where malicious JavaScript gets injected into otherwise trustworthy pages. Because the script executes in the victim's browser, it can steal authentication cookies, session data, or even display fake ads and phishing prompts to site visitors.
Cross-Site Request Forgery (CSRF)
CSRF abuses the trust a web application has in an authenticated user's browser. Attackers trick users into performing actions they didn't intend on sites where they're actively logged in—for example, a banking customer who thinks they're sending $500 to their son's account instead ships the money elsewhere because the funds-transfer endpoint was CSRF-vulnerable.
For a broader view of what to guard against, the OWASP Top Ten remains the standard reference for the most critical web application risks.
Free Tooling to Close the Gap
GitHub offers a set of developer-first security tools, free for open source projects, that address vulnerabilities at different stages of the pipeline.
Code scanning with CodeQL detects common vulnerability patterns directly in your codebase and runs inside pull requests, catching problems before they ever reach the main branch. Each CodeQL query doubles as a teaching aid—it documents the vulnerability pattern, shows vulnerable and secure code examples, and links to external references.
Dependabot watches your dependency tree and fires alerts when a new GitHub-reviewed advisory affects packages you're using. It suggests updates to safe versions and, for supported ecosystems, can open the pull request automatically. Each advisory includes the description, severity, impact, and available references or workarounds.
Secret scanning catches credentials for third-party services that accidentally land in your source code. GitHub partners with companies worldwide to automatically invalidate leaked secrets, and the platform now recognizes more than 69 different token types. If you use GitHub Advanced Security, you can also define custom secret patterns.
Whether you're patching legacy code or reviewing new pull requests, these tools give you a practical way to reduce the 85% of codebases carrying known vulnerabilities—starting with the code you're about to merge.
