GitHub · GH-500
Dependencies, advisories, and SBOMs
GH-500 · Lesson 7 of 16 · 53:43
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: the tools of dependency security, the dependency graph with direct and transitive dependencies, the dependency submission API, the GitHub Advisory Database with reviewed, unreviewed, and malware advisories, GHSA identifiers, CVSS, and EPSS, and SBOM exports in SPDX from the interface, the REST API, and GitHub Actions. Includes three original practice questions.
Preview the topics
- Contoso’s loan portal declares 12 packages in its manifest, but its lock file resolves more than 300. Which of them appear in the dependency graph?
- A new vulnerability appears in the National Vulnerability Database for a package Contoso uses, and shows up as unreviewed in the GitHub Advisory Database. What does Dependabot do?
- Contoso’s compliance team needs a machine-readable SBOM every week, attached to an automated report, without anyone clicking in the interface. What should they use?