GitHub · GH-500
Vulnerability context and remediation
GH-500 · Lesson 12 of 16 · 1:38:48
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: CVE, CWE, and GHSA identifiers, with CVSS and EPSS, GitHub as a CVE Numbering Authority, repository security advisories with private forks and CVE requests, private vulnerability reporting, and end-to-end remediation paths for each alert type. Includes three original practice questions.
Preview the topics
- Contoso wants an auto-triage rule that handles every Dependabot alert for a given class of weakness, like path traversal, whatever the package. Which identifier should the rule use?
- Contoso wants researchers to report vulnerabilities in its public SDK privately on GitHub, so the report becomes a draft advisory the maintainers can work on. What should the maintainers enable?
- Contoso fixed the reported flaw in its SDK, and wants every downstream project using the vulnerable version to be warned and offered the fix. What completes the workflow?