GitHub代码安全：发现漏洞，自动修复

内容管家
AI领域评论13字数 443阅读1分28秒阅读模式

导语

GitHub 推出 Code Security，将安全能力深度嵌入开发者工作流。该平台通过静态分析、AI 驱动的修复建议、依赖扫描与漏洞管理，帮助团队在现有 GitHub 流程中自动发现、排序并修复安全问题，实现"开发即安全"。

正文图片

核心数据

指标 数据
从发现漏洞到修复的平均耗时 28 分钟
Copilot Autofix 平均修复速度提升 3 倍
支持 AI 修复建议的告警类型占比 90%

主要功能

Copilot Autofix

Copilot Autofix 利用 AI 分析 CodeQL 识别出的安全漏洞，结合代码上下文生成精准修复方案。开发者可在工作流中直接预览并应用 AI 建议，大幅缩短漏洞修复周期。

What is GitHub code security?

依赖分析（Dependency Review）

依赖审核&查验在拉取请求阶段扫描有漏洞的依赖项，通过对比基准分支与头部分支，清晰呈现新增、移除及更新的依赖包及其已知漏洞，防止安全问题合并入代码库。

The image displays a code snippet from a JavaScript file named "collection.js" located in the "routes" directory. The code is highlighted in three steps, with Step 1 being the focus. In Step 1, the variable "jsonQuery" is assigned the value of "req.query.query". The code snippet includes four lines where variables are defined and assigned values from the request query object. The background has a gradient blue color.

安全 Campaign

Security Campaigns 提供结构化框架，支持跨仓库、跨团队规划、跟踪和执行安全修复。安全团队可将同类漏洞分组、设定优先级、分配责任人，并通过统一仪表盘监控进度，适用于按漏洞类型、合规要求或安全项目组织的修复工作。

The image displays a code snippet from a JavaScript file named "collection.js" located in the "routes" directory. The code is highlighted in three steps, with Step 1 being the focus. In Step 1, the variable "jsonQuery" is assigned the value of "req.query.query". The code snippet includes four lines where variables are defined and assigned values from the request query object. The background has a gradient blue color.

EPSS 风险评估

Dependabot 告警现已集成 FIRST（全球事件响应与安全团队论坛）的利用预测评分系统（EPSS）。EPSS 预测漏洞在未来 30 天内被利用的概率，提供 0~1（0~100%）的评分及百分位排名，辅助团队更科学地排序修复优先级。

The image displays a dashboard for an SQL injection (CWE-89) campaign aimed at remediating Cross-Site Scripting (XSS) vulnerabilities. The dashboard has three main sections: Campaign progress, Status, and Copilot Autofix. In the Campaign progress section, it shows 97% completion with 701 alerts, where 701 are closed and 13 are in progress. It also notes that the campaign started 20 days ago. The Status section indicates there are 7 days left until the deadline on November 15, 2024. The Copilot Autofix section mentions that there are 670 supported alerts and provides information about how Copilot Autofix can help fix these alerts automatically.

延伸阅读

历史上的今天
3 月
25
 
内容管家

发表评论