GitHub · GH-500
Secure SDLC and security strategies
GH-500 · Lesson 2 of 16 · 11:06
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: how Secret Protection and Code Security differ and work together, an end-to-end secure SDLC from push to pull request, merge, and default branch, prevention-first strategies versus late security gates, a prevention-first rollout plan, and security campaigns that burn down security debt. Includes three original practice questions.
Preview the topics
- A developer adds a new package with a known critical vulnerability in a pull request. Which feature shows the problem before the pull request merges?
- Contoso wants to keep new secrets out of all repositories, with the least friction for developers and before any cleanup. Which step comes first?
- Contoso has 200 open SQL injection alerts across 40 repositories, and wants them fixed by the end of the quarter, with one named contact and tracking in each repository. What should the security team create?