Application security

• Unable to identify dependencies and vulnerabilities of the OSS used by the company, and unable to identify the scope of impact
• According to internal rules, secret information should not be mixed into the source code, but it is not thoroughly enforced.
• I used a static analysis tool in the past, but I gave up on using it because a huge number of alerts were generated and the operation did not go well.

Security for users

• Since developers can edit the public settings of the repository themselves, there is a risk that confidential information such as corporate assets will be leaked.
• There is a risk of ID/password being stolen, personal access tokens or SSH keys being leaked, and unauthorized login being performed.
• An employee left the company, but was still accessible after leaving the company

Application Security

supply chain

of open source components
Stay safe and compliant

code

as part of the workflow
Detect and fix code vulnerabilities

Development lifecycle

security and compliance
Create and execute policies as code

Developer Security

supply chain

by permission settings
Prevention of confidential information leaks

code

By checking the connection source
secure access

Development lifecycle

Level of trust with multi-factor authentication and authorization
Access control according to

Effects of Code Scanning

• Find vulnerabilities early in development
  Reduce remediation costs by preventing known vulnerabilities during the development phase
• Accurate analysis
  CodeQL interprets the call graph of the code and the meaning of the code and performs analysis, so it achieves very high accuracy (= few false positives). It also reduces the time spent reviewing analysis results.
• prioritized alerts
  Analysis results are prioritized in 3 stages, so you can deal with the most important ones first
• Leverage community
  Leverage queries created by GitHub, other companies and the open source community