Cram Sheet323 words
Topic 4.3 — Security and compliance scanning — cram sheet
Topic 4.3 — Security and compliance scanning · cram sheet
Four scan types
Dependency · code (SAST) · secret · licensing.
- Push protection blocks a secret before it enters history. Detected after → rotate; the commit is permanent.
- Continuous alerting catches CVEs disclosed after the code stopped changing.
- Block on unambiguous + fixable; report on judgement, or the gate gets bypassed.
GitHub Advanced Security
Code scanning (CodeQL) · secret scanning · dependency review.
| Setup | Use when |
|---|---|
| Default setup | Standard projects — no workflow file to maintain |
| Advanced setup | Custom build, CodeQL in a container, custom query suites |
GHAS for Azure DevOps = the same capabilities on Azure Repos. No migration to GitHub required.
Defender for Cloud DevOps Security
- Aggregates and correlates — it does not scan the code. GHAS does the scanning.
- Connectors: Azure DevOps · GitHub · GitLab.
- Value: map a cloud finding back to the repository and template that produced it.
- Order: enable GHAS → enable DevOps Security plan → create connector → findings flow. Wrong order = inventory, no findings.
Container scanning
- Scan before push (keep bad images out) and continuously in the registry (catch new CVEs).
- CodeQL in a container requires advanced setup.
- Most base-layer findings are fixed by rebuilding on a patched base, not by changing code.
Dependabot — the three features
| Feature | Does |
|---|---|
| Alerts | Tell you a dependency is vulnerable |
| Security updates | Raise a PR to a fixed version |
| Version updates | Keep dependencies current regardless |
.github/dependabot.yml configures version updates only. Alerts and security updates are enabled in repository/organisation settings — the most common real-world confusion.
Dependency review surfaces licences of dependencies a PR introduces.
Staying current is security: several majors behind means a patch needs a migration first.