Github - Security関連

「.NET 開発基盤部会 Wiki」は、「Open棟梁Project」,「OSSコンソーシアム .NET開発基盤部会」によって運営されています。

• 戻る

目次 †

概要 †

今、OSSの脆弱性が熱い。

詳細 †

• Node.js ＋ npm 系はアラートが良く出る。
• FrontendTemplates?を参考に説明。

GitHub Code Scanning (CodeQL) †

GitHub Dependabot †

その他の機能 †

助言 †

リポジトリのコード内のセキュリティの脆弱性に関する情報を非公開で議論、修正、公開

https://github.com/OpenTouryoProject/FrontendTemplates/security/advisories

ポリシー †

• セキュリティ・ポリシーを設定
• コントリビュート（Readme.md）のセキュリティ版

https://github.com/OpenTouryoProject/FrontendTemplates/security/policy

参考 †

GitHub Help †

• Managing security vulnerabilities
  https://help.github.com/en/github/managing-security-vulnerabilities

• Managing security vulnerabilities in your project
  https://help.github.com/en/github/managing-security-vulnerabilities/managing-security-vulnerabilities-in-your-project
  • Adding a security policy to your repository
  • About GitHub Security Advisories
  • Permission levels for security advisories
  • Creating a security advisory
  • Adding a collaborator to a security advisory
  • Removing a collaborator from a security advisory
  • Collaborating in a temporary private fork to resolve a security vulnerability
  • Publishing a security advisory
  • Editing a security advisory
  • Withdrawing a security advisory

• Managing vulnerabilities in your project's dependencies
  https://help.github.com/en/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies
  • Browsing security vulnerabilities in the GitHub Advisory Database
  • About security alerts for vulnerable dependencies
  • Configuring automated security updates
  • Viewing and updating vulnerable dependencies in your repository
  • Managing alerts for vulnerable dependencies in your organization